CCPA Compliance Checklist: 60 Checks for Privacy, IT and Security
Use it to see where you stand. Each check names an owner, and the page keeps score as you go.
Tick only what you can prove today
If you cannot show a configuration, a record or a signed document for a check, treat it as a gap.
A checklist built from the law, the regulations and enforcement cases
Most checks come straight from the CCPA, CalPrivacy’s regulations or failures regulators have already penalized; the rest are practices that make those duties provable. The security controls in section 7 are cybersecurity audit components, which an auditor assesses where they apply. Owners show who usually does the work.
Go section by section. Tick a check only when you can show evidence for it. Your score updates as you go. This checklist does not save your answers or send them to us; they clear when you close or reload the page.
60 checks in eight areas
Owners show who usually does the work. Tick a check only when you can show evidence for it.
Tick each check you can prove with evidence.
1. Applicability and governance0 of 6
2. Data inventory and minimization0 of 7
3. Notices and links0 of 7
4. Consumer requests0 of 10
5. Opt-outs and consent0 of 7
6. Vendors and contracts0 of 5
7. Security controls0 of 12
8. Training, incidents and evidence0 of 6
How to read your score, and what to fix first
55 to 60
Most checks are covered. Keep the evidence current and test opt-outs and requests regularly.
40 to 54
Gaps remain. Start with the areas enforcement actions cite most: opt-outs, consumer requests, vendor contracts and encryption.
Under 40
Start with the roadmap: applicability, the data map, then requests and opt-outs. Book a readiness assessment.
Score bands are practical guidance, not a legal standard or a compliance determination. A single missing item, such as a broken opt-out, can still lead to a penalty.
Turn your gaps into a plan
Plan the fixes
Eight phases with owners and outputs, and the deadlines from 2026 to 2030.
Prepare for the audit
If you are in scope, controls and evidence must work from the first day of your audit period.
Page 10 of 10: CCPA compliance checklist
- 1. CCPA and CPRA compliance (hub)
- 2. CCPA vs CPRA explained
- 3. Does the CCPA apply to your business?
- 4. Consumer rights and privacy requests
- 5. Penalties, fines and lawsuits
- 6. Implementation roadmap
- 7. CCPA for IT administrators
- 8. CCPA cybersecurity audit
- 9. Risk assessments and ADMT
- 10. CCPA compliance checklist (this page)
Guided by Ali Hassani, CISSP, C|CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure, who has earned dozens of Microsoft and Cisco certifications over his career, including MCSE, MCITP, MCSA Security, CCNP and CCNA. OC Security Audit handles the technical side of the CCPA: data inventories, security controls and evidence as your readiness advisor, or the cybersecurity audit as your independent auditor, one role per program. Legal interpretation stays with your privacy counsel.
Questions business owners and IT leaders ask
Is this checklist enough to be compliant?
No checklist can confirm compliance. This one covers the main obligations, but compliance depends on your facts and on legal judgment. Use it to find gaps, and confirm legal questions with counsel.
Does the page save my answers?
No. This checklist does not save your answers or send them to us, and they clear when you close or reload the page. Our privacy policy describes the analytics used across the site. Print or note your results before you leave.
Which items carry the most risk?
Broken opt-outs, ignored Global Privacy Control signals, over-verification of requests, missing vendor contracts and unencrypted personal information. They are recurring themes in CCPA enforcement actions and breach lawsuits.
Can you verify our answers?
We can test the technical and security checks against evidence, read-only, flag the legal items for your counsel to confirm, and give you a prioritized list of fixes.
General information, not legal advice
This page summarizes California privacy law and regulations as of October 2026 to help businesses plan their cybersecurity and IT work. It is general information, not legal advice. It does not create an attorney-client relationship and does not guarantee compliance or any outcome. OC Security Audit is a cybersecurity firm, not a law firm. Confirm how the CCPA applies to your business with qualified California privacy counsel. Enforcement examples summarize the regulators’ public announcements; settlements can resolve allegations without an admission of wrongdoing. Laws, regulations and inflation-adjusted amounts change, so check the primary sources below.
Primary sources · Last reviewed October 2026
- California Civil Code, Title 1.81.5: California Consumer Privacy Act
- CalPrivacy: text of the CCPA regulations on cybersecurity audits, risk assessments and ADMT (effective January 1, 2026)
- Cal. Code Regs. tit. 11, §7101, record-keeping (Cornell Legal Information Institute)
- California Legislature: SB 446, data breach notification deadlines
- CalPrivacy: SB 923 strengthens deletion rights (signed September 27, 2026)
- CalPrivacy: data brokers and the DROP deletion platform
- Global Privacy Control specification and browser support
Want someone to check the checklist?
Schedule a consultation. We test the technical and security answers against evidence, read-only, and show which gaps to close first.
Read-only reviews. Irvine, Orange County and Southern California on-site; remote nationwide.