CCPA/CPRA: every control, and what you already have

32 controls 12 frameworks share controls with it United States - California verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

If you run	Shared controls
GDPR	27	measure it →
APEC Cross-Border Privacy Rules (CBPR) System	24	measure it →
Australian Privacy Principles (APPs)	21	measure it →
ISO 27701:2019	21	measure it →
APPI	20	measure it →
SOC 2	16	measure it →
China Personal Information Protection Law (PIPL)	6	measure it →
Colorado Privacy Act	6	measure it →
Connecticut Data Privacy Act (CTDPA)	6	measure it →
COPPA	4	measure it →
Delaware Online Privacy and Protection Act (proposed)	4	measure it →
California IoT Security Law	1	measure it →

Every control

Code	Control	Also in
`CCR §7012`	Notice at Collection Drafting Requirements	8
`CCR §7025`	Opt-Out Preference Signal Configuration	2
`CCR §7026`	Requests to Opt-Out of Sale/Sharing Handling	5
`CCR §7027`	Requests to Limit Use of Sensitive PI Handling	3
`CCR §7050`	Service Provider and Contractor Obligations	6
`CCR §7060`	Consumer Identity Verification	5
`CCR §7100-7102`	Recordkeeping Requirements	3
`CCR §7301-7304`	CPPA Audit and Investigation Cooperation	2
`Sec.1798.100(c)`	Data Minimisation, Necessity and Proportionality	0
`§1798.100`	General Duties of Businesses that Collect Personal Information	8
`§1798.100(d)`	Contractual Requirements for Third Parties, Service Providers, and Contractors	6
`§1798.105`	Right to Delete Personal Information	10
`§1798.106`	Right to Correct Inaccurate Personal Information	7
`§1798.110`	Right to Know Categories and Specific Pieces of Personal Information Collected	9
`§1798.115`	Right to Know Personal Information Sold or Shared and Recipients	6
`§1798.120`	Right to Opt Out of Sale or Sharing of Personal Information	11
`§1798.121`	Right to Limit Use and Disclosure of Sensitive Personal Information	6
`§1798.125`	Non-Discrimination for Exercise of Rights	5
`§1798.130(a)(1)`	Designated Methods for Submitting Consumer Requests	5
`§1798.130(a)(2)`	45-Day Response Window and Identity Verification	6
`§1798.130(a)(3)`	Privacy Policy Content Requirements	6
`§1798.130(a)(5)(C)`	Notice at Collection	8
`§1798.130(c)`	Annual Metrics Disclosure (Large Businesses)	1
`§1798.135(a)`	Do Not Sell or Share My Personal Information Link	6
`§1798.135(b)`	Opt-Out Preference Signals (Global Privacy Control)	4
`§1798.135(c)`	Authorized Agent Requests	3
`§1798.140`	Threshold for Applicability and Key Definitions	3
`§1798.145`	Exemptions and Permitted Activities	0
`§1798.150`	Private Right of Action for Data Breaches	7
`§1798.155`	Administrative Enforcement and Civil Penalties	0
`§1798.185(a)(15)`	Risk Assessments for High-Risk Processing	3
`§1798.185(a)(16)`	Automated Decisionmaking Technology Access and Opt-Out	2

Tell me when CCPA/CPRA files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

Request workflow with SLA timers
Extension notification templates and logs
Identity verification policy (matching to existing records, signed declaration)
Look-back data retention configuration
SLA management for cloud services
SLA monitoring records

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

No SLA monitoring named by 3 frameworks

What this page is

A control-level reference for CCPA/CPRA, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition