Proof of Record-Keeping for CCPA Requests

In accordance with California Consumer Privacy Act (CCPA) article §999.317, businesses must be able to provide proof of record-keeping upon consumer or Attorney General inquiry about the organization's privacy practices or the organization's compliance with CCPA.

Additionally, records of consumer requests and how the business responded to them must be maintained for at least 24 months. If your organization handles the personal information of 10,000,000 or more consumers, you must retain these metrics for the previous calendar year.

Required Information

A ticket or log format is acceptable as proof of record-keeping if it includes all of the following information, per §999.317(c):

  • Date of request

  • Nature of request (Access, Deletion, Opt-out of Sale)

  • Manner in which request was made (Web Form, Toll-Free Number, Mail, etc.)

  • Date of business response (recommended to keep both the response date and date of substantive answer)

  • Nature of response (complied in part, in whole, or denied)

  • Basis for denial if request is denied in part or in whole

Fulfilling CCPA Requests

The OneTrust Privacy Rights Automation module provides web forms and workflow templates specifically configured to intake, process, and fulfill CCPA requests. In the event of an inquiry, privacy professionals can leverage these tools and create reports to comply with the CCPA's requirements for proof of record-keeping.

For more information about CCPA and consumer rights, see DSAR Best Practices: Processing CCPA Opt-Out Requests.

  • The Request Queue centrally maintains request evidence, which includes details such as date and nature of request, submission source, activity history with timestamps, resolution codes, and more. For more information about customizing web forms and workflows to meet these requirements, see Customizing a Web Form and Customizing a Workflow.

  • Reporting for proof, from the Request Queue or the Reports module. For more information, see Reporting Options for Privacy Rights Automation and Consumer Rights.

  • Records are kept indefinitely until consumers choose to delete them.