Data Privacy Hub

The CCPA requires businesses over a certain threshold to disclose certain metrics about their CCPA compliance by July 1. These reporting obligations apply to any business that is subject to the CCPA and “knows or reasonably should know that it, alone or in combination, buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes the personal information of 10,000,000 or more California residents in a calendar year.” 

Scope:

Businesses subject to the reporting obligations / business who meet this threshold, must, by July 1st of every year, publish the following metrics for the previous calendar year. 

1. The number of requests to know that the business received, complied with in whole or in part, and denied;
2. The number of requests to delete that the business received, complied with in whole or in part, and denied;
3. The number of requests to opt-out that the business received, complied with in whole or in part, and denied; and
4. The median or mean number of days within which the business substantively responded to requests to know, requests to delete, and requests to opt-out.

The metrics must be disclosed in the business’s privacy policy or posted on the business’s website and accessible via a link in the business’s privacy policy.