California Privacy Rights Act (CPRA) is more about data privacy management. Data Sharing, Selling Consumer Personal Information, and any disclosure of personal information to third parties wherein the third-party profiles the customer based on their personal information that they may have gained from service providers.

CPRA enforcement takes effect from January 1, 2023. However, California Customer Privacy Act (CCPA) continues to apply until CPRA takes effect. You may say that CPRA is an amended version of CCPA. It is not clear whether CCPA will continue to exist after the enforcement of CPRA effective January 01, 2023.

How to find out if CPRA applies to my organization?

If your answer to the following question is “YES”, probably you need to start working on CPRA Compliance before you run out of time!!

• Is your organization conducting business in the state of California or with the residents or citizens of California?
• Does your products or services/solution collect any Personal Information about the consumer residing in California?
• Does your organization sell or share California’s residents/citizens’ Personal Information as part of a business process?

If your answers are “YES” to the above questions, then you may be required to comply with CPRA on or before January 1, 2023.

There are a few other conditions that your organization must validate to arrive at the final decision on how to comply and what technical and process requirements need to be in place as baseline security and privacy controls

Connect with us to get to know whether CPRA is applicable for your organization!

Most organizations now expanding their business to the rest of the world either by SaaS products/Services or offering their services at multi-regions are forced to comply with multiple security and privacy standards.

EU-GDPR is one such Compliance that organizations must take seriously, and failing to identify the requirements and claiming ignorance is even the worst situation an organization may be in. It doesn’t mean that CPRA can be considered less severe since both EU-GDPR and CPRA fall under the “Regulation/Act” Category, and failing to comply shall lead to heavy penalties and business closure.

The terms “Service Provider”, “third party”, “Contractors” have been explained in detail in CPRA.

Service Provider falls broadly under the category of offering various services, i.e., cloud-based software, technical solutions and support, advisory services, and consulting support but not limited to.

Third-Party are entities nominated by the business to act on behalf of them to process the Personal Information of the consumer, which may likely be a transaction where the Personal Information about the consumer is sold to them. There may be a scenario where a third party processes the information without any sale or personal information.

There are many such scenarios where the organization would like to find their status, Below are some examples

Scenario 1: If an organization claims to be a SaaS provider and involves processing the information as per the business requirements, the SaaS provider performs profiling the consumer data and sells the consumer analyzed data. If so, the organization needs to comply with CPRA compliance.

Scenario 2: If an organization is established in the USA and they have another office in India, wherein they are acting as the service provider or third party to process the Californian residents or citizen personal information by which they amaze $25 million or more as gross revenue in the preceding Calendar Year, then the organization needs to comply with CPRA compliance. 

The CPRA Compliance strengthens and expands the CCPA’s reach, increasing the breadth and depth of present access and deletion rights.

Businesses need to keep informed about potential changes and track how they impact their operations. Organizations can get ahead of the market by implementing processes and procedures as early as possible.

As California continues to lead the conversation on data privacy in the United States, businesses that build the necessary strategies and processes to stay up with the ever-changing data privacy scenario will achieve robust regulatory Compliance.

You can also read the steps involved in achieving CPRA Compliance 

With much such Security and Privacy compliance within various states of the USA, it is recommended that organizations have their baseline of security and privacy compliance implemented so that they are in no big surprises later. Cyber Security and Privacy are here to stay, and with much stringent controls and audits result in heavy fines and penalties if not adhered to.