FRAMEWORKS / READINESS / Privacy
CCPA / CPRA
California consumer privacy rights, where the organization falls within scope.
SCOPE & APPLICABILITY
What the framework actually requires
California privacy legislation; obligations and exemptions depend on the business.
What matters in practice
Requirements depend on scope. These are the areas to evaluate, not a guarantee of certification or regulatory compliance.
Applicability assessment
Identify relevant operations.
Consumer requests
Define consumer request handling.
Notice, sharing, and retention
Document ongoing privacy safeguards.
An operational path, not a checkbox exercise
Translate requirements into accountable activities, evidence and reviewed controls.
Identify relevant operations.
Define consumer request handling.
Document ongoing privacy safeguards.
APPLICABILITY
Who should assess this framework?
For businesses in scope of California consumer privacy legislation; applicability depends on business operations, statutory thresholds and exemptions.
BEYOND CHECKLISTS
Why this matters
A programme should link notices, rights requests, collection flows, vendors and retention—not stop at a cookie banner.
EVIDENCE & OPERATIONS
What your organisation should be able to evidence
This is a practical starting point, not an exhaustive set of regulatory obligations or a substitute for an independent audit.
- 01 CCPA/CPRA threshold and applicability assessment
- 02 Data and purpose inventory
- 03 Privacy notices and opt-out processes
- 04 Eligible consumer request procedures
- 05 Service provider and third-party agreements
- 06 Retention and sharing practice reviews
FAQ
Frequently asked questions
Practical distinctions worth understanding before starting your programme.
Does CCPA apply to every website visited from California?
Not automatically. Coverage depends on statutory definitions, thresholds and exemptions.
Does a CMP solve CCPA on its own?
No. Preference handling may be one component, alongside notices, requests and internal processes.
Is CCPA the same as GDPR?
No. These regimes have overlapping aims but different scope, rights and duties.
FURTHER READING
Explore related resources
Use original ZebraByte articles and guides to explore security programmes, privacy governance and readiness.
Framework descriptions are educational. Applicability, service availability and any independent assessment require confirmation for your organisation.
Important scope boundary
ZebraByte can discuss readiness, technical controls and programme management. A regulator, qualified auditor or certification body makes the applicable independent determination. Support for a particular framework is subject to the agreed service scope.
Related frameworks and programmes
Need a scope assessment for your organisation?
Share your sector, systems and contractual requirements. We can outline the next practical steps and clarify whether this framework is relevant.