CCPA / CPRA

California privacy: data processing software inventory, vendor documentation, license transparency.


Short name	CCPA
Region	Americas
Country or scope	United States
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers CCPA

Scan requirements: 4, all decided by a scan.
Controls: the scan requirements below, plus 14 controls from Safeguard's control catalog for CCPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 26: 4 written for CCPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 4 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`CCPA-1798.100` Data Processor Documentation	CCPA requires documentation of service providers processing personal information	Scan
`CCPA-1798.150` Privacy-Relevant Component Identification	Components handling personal information must be identified for CCPA compliance	Scan
`CPRA-1798.100(d)` Third-Party Component Transparency	CPRA requires transparency about third-party components and data sharing	Scan
`CPRA-1798.185` SBOM Creator Accountability	CPRA requires documented accountability for personal information handling	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`1798.100`	Honor Consumer Right to Know
`1798.105`	Honor Consumer Right to Delete
`1798.106`	Honor Consumer Right to Correct Inaccurate Information
`1798.110`	Disclose Categories of Personal Information Collected
`1798.115`	Disclose Third-Party Data Sharing
`1798.120`	Honor Consumer Right to Opt-Out of Sale or Sharing
`1798.121`	Honor Consumer Right to Limit Use of Sensitive Personal Information
`1798.125`	Ensure Non-Discrimination for Exercising Rights
`1798.130`	Implement Designated Methods for Consumer Requests
`1798.135`	Maintain Privacy Policy and Notice at Collection
`1798.140`	Classify and Track Sensitive Personal Information
`1798.150`	Implement Reasonable Security for Personal Information
`1798.185(a)`	Establish Privacy Risk Assessment Program
`1798.100(d)`	Manage Contractor and Service Provider Data Use

Policy templates

Written for CCPA:

CCPA/CPRA Privacy Notice and Policy
CCPA/CPRA Consumer Rights Request Handling Policy
CCPA/CPRA Reasonable Security and Data Protection Policy
CCPA/CPRA Service Provider and Contractor Data Agreements Policy

And 22 from the standard set, adapted to CCPA.