CCPA Compliance for Data Teams

The California Consumer Privacy Act (CCPA) - significantly expanded by the California Privacy Rights Act (CPRA) - is one of the most comprehensive US state privacy laws, granting California residents rights over the personal information businesses collect about them. CCPA compliance for data teams is the practical work of being able to answer, at any moment, the questions the law makes consumers entitled to ask: what personal information do you hold about me, where did it come from, who did you share it with, and can you delete it?

For a data team, this is less a legal problem than a data-management one. A privacy lawyer can interpret the statute, but only the data team can actually find every copy of a consumer's personal information across warehouses, lakes, pipelines, and SaaS exports, trace where it flowed, and delete it on request. CCPA compliance matters because the gap between the legal obligation and the data reality is exactly where violations - and the penalties that follow - live.

What the CCPA Is

The CCPA took effect on January 1, 2020 and was strengthened by the California Privacy Rights Act (Proposition 24, approved November 2020, operative January 1, 2023), which added the rights to correct and to limit use of sensitive personal information, created the California Privacy Protection Agency, and tightened obligations. Together they form California's baseline privacy regime. The law defines personal information broadly - not just obvious identifiers like name and email, but anything that could reasonably be linked to a consumer or household, including device IDs, location, browsing history, and inferences drawn about a person. A subcategory, sensitive personal information (precise geolocation, health information, racial or ethnic origin, government ID numbers, financial account log-in credentials, and more), carries extra obligations.

The CCPA is often compared to the EU's GDPR, and they share DNA - both grant access and deletion rights and demand transparency. But the emphases differ: GDPR requires a lawful basis (consent is one of six) for any processing, while the CCPA centers on the sale and sharing of personal information and a consumer's right to opt out of it. A team that is GDPR-ready has a strong head start on CCPA, but the two are not interchangeable.

Who It Applies To

The CCPA applies to for-profit businesses that do business in California, collect Californians' personal information, and meet at least one threshold. As amended, these are commonly summarised as:

• Revenue - annual gross revenue above $25 million, adjusted for inflation ($26,625,000 since January 2025); or
• Volume - buying, selling, or sharing the personal information of 100,000 or more consumers or households a year; or
• Data-driven revenue - deriving 50% or more of annual revenue from selling or sharing personal information.

The law is not limited to companies headquartered in California: any qualifying business that does business in the state and collects Californians' personal information is covered (conduct that takes place wholly outside California is exempt). Because California is so large, many US businesses treat the CCPA as their baseline. Dollar thresholds are adjusted for inflation every two years, so the current statutory text and CPPA guidance are the authority - but the practical takeaway for data teams rarely changes: assume it applies and build accordingly.

The Consumer Rights

The heart of the CCPA is a set of consumer rights, each of which translates into a concrete demand on the data team:

• Right to know. Consumers can request what personal information you hold, where it came from, why you collected it, and the categories of third parties you disclosed it to - which means you must be able to find every copy and trace its lineage.
• Right to delete. Consumers can ask you to erase their data, with some exceptions - which means locating and deleting it across every system, including downstream copies.
• Right to correct. Consumers can have inaccurate data fixed - which requires knowing the source of truth for each field.
• Right to opt out of sale/sharing. Consumers can stop you selling or sharing their data - which requires tagging and gating exactly that data.
• Right to limit use and disclosure of sensitive personal information. Consumers can restrict how their sensitive data is used - which requires classifying sensitive personal information distinctly.

And consumers may not be discriminated against for exercising any of these rights. Non-compliance carries real penalties - administrative fines (CPPA) or civil penalties (Attorney General) of up to $2,663 per violation, or $7,988 for intentional violations or violations involving consumers known to be under 16 (2025 inflation-adjusted amounts), plus a private right of action for certain data breaches caused by a failure to maintain reasonable security.

The Data Team's Job

Stripped of legal language, every CCPA right reduces to the same four data capabilities. A team that has these can satisfy the law; one that lacks them cannot, no matter how good its privacy policy reads:

1. Know what you hold. A complete inventory of data assets - without it, "what personal information do you have about me?" is unanswerable.
2. Know which data is personal. Classification that flags personal and sensitive information wherever it lives, including unlabeled and unstructured data.
3. Know where it flowed. Lineage that shows every downstream copy and recipient - because a deletion that misses three derived tables is not a deletion.
4. Act on it. The workflows and access controls to fulfil, log, and prove each request within the law's deadlines (45 days for requests to know, delete and correct, extendable once; 15 business days for opt-outs).

The recurring failure is the forgotten copy: personal data duplicated into a data mart, an export, or a model's training set that no one tracked. Under the right to delete, that copy is a violation waiting to be found.

How Dawiso Approaches It

Every one of those four capabilities is a data governance capability, which is why CCPA readiness is a by-product of good governance rather than a separate compliance tool. A governed catalog gives the data team the complete inventory the right to know depends on; AI-assisted classification finds and tags personal and sensitive information across the estate so nothing is missed; and interactive data lineage traces every downstream copy, turning a deletion or disclosure request from a frantic search into a precise, evidenced operation. Combined with stewardship and access workflows, the catalog becomes the system of record that proves - to a regulator or a consumer - that a request was honoured completely. The same foundation that answers GDPR requests answers CCPA ones; the law changes, but the underlying need to see and trace your data does not.

Conclusion

CCPA compliance looks like a legal obligation but lands as a data-engineering one. The consumer rights it grants - to know, delete, correct, opt out, and limit - all resolve to a single question the data team must be able to answer on demand: where, exactly, is this person's data? Teams that can answer it have already done the hard work of cataloging, classifying, and tracing their data; teams that cannot will find that no privacy policy substitutes for knowing where the data actually is. Build the visibility first, and CCPA compliance - like GDPR before it and whatever comes next - becomes a capability you already have rather than a deadline you race toward.

Sources

• California Privacy Protection Agency, California Consumer Privacy Act of 2018, Cal. Civ. Code §1798.100 et seq. (effective January 1, 2026) (consumer rights, thresholds, sensitive personal information, response deadlines, penalties).
• California Privacy Protection Agency, CCPA Monetary Thresholds (the inflation-adjusted revenue threshold and fine amounts).
• California Privacy Protection Agency, California Consumer Privacy Act Regulations (request handling, including deletion from backup systems).
• California Attorney General, California Consumer Privacy Act (CCPA) (effective date, CPRA amendments, enforcement).
• California Privacy Protection Agency, About CalPrivacy (the regulator created by Proposition 24).
• Publications Office of the EU (EUR-Lex), Regulation (EU) 2016/679, General Data Protection Regulation (the six lawful bases in Article 6).