CCPA & CPRA compliance
California Consumer Privacy compliance built for engineering
Automate consumer privacy rights, service provider contract tracking, and sensitive personal data inventories under California privacy laws.
What CCPA / CPRA is
The California Consumer Privacy Act (CCPA), as strengthened by the California Privacy Rights Act (CPRA), grants California residents enforceable privacy protections.
It provides rights to know what personal data is collected, delete data, opt out of the sale or sharing of personal data, and limit the use of sensitive personal information.
Organizations must execute compliant Service Provider and Contractor agreements, maintain a comprehensive data inventory, and maintain auditable consumer request logs.
Who needs CCPA / CPRA
You do business in California and have annual revenue over $25M, handle personal data of 100,000+ California consumers, or derive 50%+ of revenue from data sharing.
How TrustLynce helps with CCPA / CPRA
Consumer rights workflow
Automate request intake, verification, and fulfillment across data stores within 45-day statutory windows.
Opt-out & consent tracking
Enforce "Do Not Sell or Share My Personal Info" requests across tracking tags and third-party vendors.
Service provider oversight
Maintain mandatory CPRA contract provisions and track third-party vendor data usage boundaries.
CCPA / CPRA questions
CCPA focuses heavily on the sale and sharing of personal information and opt-out mechanisms, while GDPR requires an affirmative lawful basis (such as consent) before processing.
Yes. Since 2023, California employees and job applicants possess full CPRA data rights regarding their employment information.
Other frameworks
Evidence collected for one framework carries into the next.
SOC 2
The one your buyers ask for
ISO 27001
Recognised worldwide
HIPAA
Protect health information
GDPR
Handle EU personal data
PCI DSS
Take card payments safely
ISO 42001
Govern how you use AI
NIST CSF
A common security language
CMMC
Work with the DoD
Custom
Your own control set
ISO 27701
Privacy extension to ISO 27001
DORA
EU financial operational resilience
NIS 2
EU critical infrastructure cybersecurity
FERPA
Student education privacy standard
FDA 21 CFR Part 11
FDA electronic records & signatures
HDS Certification
French health data hosting certification
SOX ITGC
IT controls for public companies
HITRUST CSF
Assurance healthcare buyers ask for
FedRAMP
Sell cloud services to US agencies
NIST SP 800-53
The federal security control catalog
NIST SP 800-171
Protect CUI on federal contracts
Find out what your compliance program actually looks like
Thirty minutes, your real systems, no slideware. We'll show you what we'd automate first, and what you don't need us for.