Get audit-ready for CCPA
CCPA / CPRA · California Consumer Privacy Act / California Privacy Rights Act
California state law granting consumers rights over their personal information including the right to know, delete, opt-out of sale/sharing, and non-discrimination. CPRA amendments strengthen enforcement via the California Privacy Protection Agency.
CCPAWhat is CCPA?
California state law granting consumers rights over their personal information including the right to know, delete, opt-out of sale/sharing, and non-discrimination. CPRA amendments strengthen enforcement via the California Privacy Protection Agency.
Who it applies to
For-profit businesses meeting defined thresholds that handle the personal information of California residents. Being outside the US is no defence - the test is who the data belongs to.
How the standard is organised
Framed as consumer rights - to know, delete, correct, and opt out of sale or sharing - with corresponding business obligations, rather than as a control catalogue.
Framework names, marks and abbreviations (ISO, SOC 2, PCI DSS, TISAX, HIPAA, GDPR and others) are trademarks of their respective standards bodies and are used here only to describe what the Bitkosh Readiness Platform helps you track and prepare for. The badges shown are original Bitkosh artwork, not the official marks. Bitkosh Technologies is not affiliated with, sponsored by, or endorsed by ISO, AICPA, the PCI Security Standards Council, ENX/VDA, or any other framework owner, and using this platform does not by itself confer or guarantee certification — certification/attestation is granted only by the relevant accredited third-party body.
CCPA on the Bitkosh platform
The 37 CCPA controls sit in one workspace with gap assessment, evidence collection and your readiness score, and shared controls count towards the equivalent requirement in the other 47 ready frameworks at the same time — so a second framework costs a fraction of the first.
How the platform worksSample controls
Six controls from the platform's control library, chosen because they are the most specific to this framework.
- §1798.115Right to Know — Sale/Sharing
Consumer right to know what personal information is sold or shared and to whom
Consumer Rights - §1798.135Do Not Sell or Share Link
Provide a clear and conspicuous 'Do Not Sell or Share My Personal Information' link on homepage
Business Obligations - §1798.155(b)Penalty Amounts
Civil penalties up to $2,500 per unintentional violation and $7,500 per intentional violation or child PI violation
Enforcement & Penalties - §1798.199.55CPPA Rulemaking
CPPA authority to issue regulations implementing and interpreting the CCPA/CPRA
Enforcement & Penalties - §1798.140(j)Contractor Requirements (CPRA)
Contractors must certify understanding and compliance with CCPA restrictions on PI use
Service Provider Requirements - §1798.120Right to Opt-Out of Sale/Sharing
Consumer right to direct a business not to sell or share their personal information
Consumer Rights
More privacy & data protection frameworks
Frequently Asked Questions
Who publishes CCPA, and who does it apply to?
How is CCPA conformance demonstrated?
How is CCPA structured?
Ready to get audit-ready for CCPA?
See how the Bitkosh Readiness Platform gets you audit-ready for CCPA — and the other 47 ready frameworks — from a single control library.