The fourth and final part of this CCPA client alert series focuses on certain training and record-keeping requirements pursuant to the CCPA.

The California Consumer Privacy Act of 2018 (the “CCPA”) and the related proposed Attorney General Regulations (the “Regulations”) provide California consumers with increased privacy rights and protections with respect to their personal information. Businesses that are subject to the CCPA must comply with various notice obligations and requirements related to the collection, deletion and sale of personal information. The California Attorney General intends to begin enforcing the CCPA and the Regulations on July 1, 2020.

The CCPA and the Regulations set forth certain training and record-keeping obligations for businesses, including the following:

• All individuals responsible for handling consumer inquiries about a business’ privacy practices or the business’ compliance with the CCPA must be informed of all the requirements in the CCPA and the Regulations, as well as how to direct consumers to exercise their rights thereunder.
• A business must maintain records of consumer requests made pursuant to the CCPA and how the business responded to such requests for at least 24 months. The business must implement and maintain reasonable security procedures and practices in maintaining these records.
• If a business knows or reasonably should know that it buys, sells, receives or shares for commercial purposes the personal information of 10,000,000 or more consumers in a calendar year, it must disclose certain metrics regarding CCPA compliance in its privacy policy by July 1 of every calendar year.
• If a business meets the above 10,000,000 consumer threshold, it must also establish, document, and comply with a training policy to ensure that all individuals responsible for handling consumer requests pursuant to the CCPA or compliance with the CCPA are informed of the requirements in the CCPA and the Regulations.

This client alert provides a summary of certain training and record-keeping requirements pursuant to the CCPA and the Regulations. This is simply a summary of some key points, so check with your attorney at ECJ for the critical details regarding the CCPA and the Regulations. Client alerts related to other important aspects of the CCPA and the Regulations can be found on our blog or by reading our latest articles on Covered Businesses and Required Notices, Handling Consumer Requests and Service Providers.

For further details on whether the CCPA applies to your business, a better understanding of consumer rights under the CCPA and clarification of your company’s obligations thereunder, you can download a copy of ECJ's Business Guide to the CCPA.