DataTerminology.comNEW
Also known as: CPRA
A California law that amends and expands CCPA, creating new consumer rights, stricter obligations for businesses, and the California Privacy Protection Agency.
DESCRIPTION
The California Privacy Rights Act (CPRA) enhances the CCPA by adding rights such as correction, limiting use of sensitive personal information, and expanded opt-out for sharing. It establishes the California Privacy Protection Agency (CPPA) for rulemaking and enforcement. CPRA demands data minimization, purpose limitation, and stricter contractual controls with service providers. It affects data inventories, DPIAs, consent flows, and transparency notices. Organizations must align governance, retention, and security practices to CPRA requirements.
ALTERNATIVE DEFINITIONS
Wikipedia
The California Privacy Rights Act (CPRA), also known as Proposition 24, is a California ballot proposition passed in the 2020 general election.
Identifies origin as a ballot proposition and passage in 2020.
California Privacy Protection Agency
The CPRA amended the CCPA and created the California Privacy Protection Agency to implement and enforce the law.
Highlights the creation of the enforcement agency and amendment role.
RELATED TERMS
Data Minimization Data Subject Rights Consent Management Do Not Sell or Share Privacy by Design Data Retention Sensitive Personal Information Data Protection Impact Assessment
COMPETING TERMS
California Consumer Privacy Act (CCPA) GDPR
KNOWLEDGE AREAS
Data Privacy & Compliance Data Governance AI Governance Data Management
TARGET AUDIENCE
Data Privacy Officer Chief Information Security Officer Chief Data Officer Data Governance Manager Chief AI Officer IT Auditor
EXTERNAL SOURCES
- Wikipedia - California Privacy Rights Act
- California Department of Justice - Official CCPA/CPRA overview and guidance.
- California Privacy Protection Agency - Agency site with rules and updates.
- IAPP - Practitioner guidance on CPRA.
TOP QUESTIONS
What new rights did the California Privacy Rights Act introduce?
CPRA adds the right to correct, restrict use of sensitive personal information, and expands opt-out to sharing. It strengthens transparency and data minimization requirements.
Category: Overview
How does the California Privacy Rights Act differ from CCPA?
CPRA amends CCPA by adding rights, clarifying definitions, and creating the CPPA for enforcement. It tightens contractual and retention obligations for businesses.
Category: Differences
Who enforces the California Privacy Rights Act?
The California Privacy Protection Agency leads rulemaking and enforcement, working alongside the Attorney General.
Category: Governance
How does the California Privacy Rights Act relate to GDPR?
Both emphasize transparency and data rights, but GDPR is broader and extraterritorial in the EU. CPRA focuses on California residents and specific business thresholds.
Category: Comparison
What is considered sensitive personal information under the California Privacy Rights Act?
Categories include precise geolocation, racial/ethnic origin, health, biometrics, and financial data. CPRA allows limiting its use and disclosure.
Category: Definitions
What operational changes does the California Privacy Rights Act require?
Maintain data inventories, purpose specifications, minimized retention, consumer rights workflows, and service provider contracts with required clauses.
Category: Requirements
Does the California Privacy Rights Act require DPIAs?
CPRA directs rulemaking for risk assessments for high-risk processing; organizations should anticipate DPIA-like processes for certain activities.
Category: Risk
What are the penalties under the California Privacy Rights Act?
Penalties include administrative fines and potential civil actions. Violations involving minors can carry higher fines.
Category: Risks
How should companies demonstrate compliance with the California Privacy Rights Act?
Implement governance policies, document processing purposes, maintain records of requests, run privacy training, and monitor vendors with compliant contracts.
Category: Best practices