CCPA & CPRA Privacy Readiness Assessment

What we assess

We review personal information categories, collection and disclosure practices, notices, retention, and the operation of consumer-rights workflows. The engagement checks how sale or sharing and sensitive information are handled where relevant, and how vendors are classified and contracted. Controls should follow actual data practices rather than copied notice language.

Evidence to prepare

• Personal information inventory, collection notices, privacy policy, and data-flow records.
• Request verification and response workflows, preference handling, and escalation records.
• Vendor classifications, contractual safeguards, retention controls, and staff training.

Keep design evidence separate from operating evidence. An approved procedure shows how a control is designed; dated records show whether it ran consistently over the review period. Evidence should identify its source, owner, scope, and collection date.

What you receive

• Applicability and operational gap register for legal review.
• Remediation recommendations for notices, requests, and vendor processes.
• Ownership and evidence requirements for maintaining the privacy program.

Common questions

Can we reuse our GDPR rights-request workflow?

The intake process and evidence may be reusable, but the rights, exceptions, verification requirements, and notice obligations differ. Map the California requirements before treating the existing workflow as sufficient.

What determines the engagement timeline and cost?

The system boundary, number of entities and locations, existing control maturity, evidence availability, and assessment pathway determine the effort. Share your customer requirements and target milestone so we can define a realistic scope before proposing a schedule.