A quick reference guide for CCPA compliance

How will CCPA compliance impact businesses?

The CCPA, effective January 1, 2020, will have a significant impact on corporate privacy initiatives across all sectors of the technology, media and entertainment, and telecommunications (TMT) industries. TMT companies that may still be in the process of compliance deployment for the European Union’s (EU) GDPR have some advantages addressing the new requirements, but brands that are primarily focused on the United States and markets in the Americas largely avoided GDPR’s scope. Regardless, the rising tide of privacy concerns among consumers and legislatures globally is driving data privacy mobilization across TMT.

Considered one of the strictest privacy laws in the United States, CCPA provides California residents with the ability to control how businesses process their personal information. Businesses will now have to honor requests from California residents to access, delete, and opt out of sharing or selling their information. Additionally, businesses will have to consider a number of CCPA-specific requirements when updating their privacy programs, such as the CCPA’s prescriptive opt-out measures, and the need to stop selling consumer data upon an individual’s request.

Back to top

Third-party risks increase with new privacy regulations

With both the GDPR and CCPA compliance, third-party risk management will likely be challenging for many organizations.

In terms of compliance, working with third parties is important because the organization is responsible for what those third parties do with its data—not to mention fourth and fifth parties.

– Richard Vestuto, a managing director at Deloitte Transactions and Business Analytics LLP.¹

Any number of third parties potentially house an organization's data, including external vendors performing marketing, billing, or collections. Under the CCPA and the GDPR, the organization that gathers or processes the personal information is responsible for keeping that data private, which requires a contract in many circumstances.

Organizations should consider a thorough and complete review of existing contracts to inventory and determine which third parties might be collecting, processing, or retaining personal information on that organization’s behalf. Upon identifying those in-scope contracts, the next steps may include amending or renegotiating those contracts to achieve compliance. Additionally, consider different technologies to extract the privacy clauses involved and conduct an analysis against standards and regulatory provisions.

1 “EU GDPR: After the Deadline, What Comes Next?,” CFO Journal, January 10, 2019.

Back to top

Finding the upside of new privacy rules

Business leaders understand that doing what needs to be done to create enterprise value often means taking risks. TMT executives should consider viewing data privacy and security not just as a risk management issue but as a potential source of competitive advantage that may be a central component of brand-building and corporate reputation.

The CCPA is coming soon, and it’s likely that additional data privacy regulations will follow in the United States and globally. Planning for CCPA compliance and the potential variety of similar regulations will require focused effort from across an organization. In support of that, organizations can focus on developing mature privacy strategies, with input from all the impacted facets of a business, to manage both the CCPA’s immediate requirements as well as plan for future privacy-related concerns.

Back to top

Get in touch

Christina De Jong
Partner
Deloitte Risk and Financial Advisory

Glen Aga
Managing director | US Cyber Risk Services
Deloitte Risk and Financial Advisory

Richard Vestuto
Managing director
Deloitte Risk and Financial Advisory

Daniel (Dan) Sutter
Senior manager | US Cyber Risk Services
Deloitte Risk and Financial Advisory

Back to top