Data Privacy Compliance. CCPA, CPRA, GDPR and HIPAA

A CCPA compliance consultant in California is usually engaged once a consumer rights request has arrived and the business has discovered it has no dependable way to answer one.

Most programmes get built in the wrong order, starting with policy language and a privacy notice because those are the visible deliverables and the ones a customer or a prospect asks to see. The notice then describes practices nobody has verified, which is a written representation the business may later have to stand behind.

What a CCPA compliance consultant in California establishes first

Not to every California business. The thresholds are specific, annual gross revenue above a defined level, buying, selling or sharing the personal information of a defined number of California consumers or households, or deriving a defined share of annual revenue from selling or sharing personal information. Meeting any one brings you in scope.

Three things catch companies out. The revenue threshold is total annual revenue, not California revenue, a company with modest California activity can be in scope on the strength of its overall size. "Personal information" under California law is broad, reaching device identifiers, IP addresses, geolocation, browsing history and inferences drawn about a consumer. And since CPRA, employee and job applicant data is fully in scope, which is the point at which most B2B companies discover the law applies to them after all.

What compliance actually requires

Beyond the privacy notice; which is the part everyone does and the least of it:

• A verifiable consumer request process covering access, deletion, correction, opt-out of sale or sharing, and limitation of sensitive personal information use, with defined response timeframes and an identity verification method proportionate to the sensitivity of what is requested
• Data minimisation and purpose limitation, collecting and retaining only what is necessary for a disclosed purpose, which conflicts directly with most companies' default of keeping everything indefinitely
• Defined retention periods, disclosed and actually enforced in the systems
• Contractual terms with service providers and contractors that meet the statutory requirements. Standard vendor agreements do not, and this is the most common gap found
• Opt-out mechanisms, including recognition of opt-out preference signals
• Risk assessments for processing presenting significant risk
• Reasonable security, the private right of action for breaches of unencrypted, unredacted personal information attaches to the failure to maintain it, which is what turns a privacy programme into a litigation-exposure question

GDPR for US companies

GDPR reaches US companies offering goods or services to people in the EU or monitoring their behaviour, no European establishment is required. Companies typically discover this through a customer's data processing agreement rather than through their own analysis.

Practical scope: establishing a lawful basis for each processing activity, which is more demanding than the consent-focused summary suggests; the Article 30 record of processing activities; data subject rights with a one-month response clock; international transfer mechanisms, which have been through repeated legal upheaval and need current rather than legacy documentation; Data Protection Impact Assessments for high-risk processing; a 72-hour breach notification obligation to the supervisory authority; and whether an EU representative or Data Protection Officer is required.

Overlap with CCPA is substantial in mechanism (inventory, rights handling, vendor terms) and materially different in legal structure. Building one programme that satisfies both is achievable and considerably cheaper than running two.

HIPAA and HITECH

Relevant to covered entities and, increasingly, to the business associates serving them, a category that catches many technology companies who did not consider themselves healthcare businesses until a health system sent them a business associate agreement.

The Security Rule requires a documented risk analysis, and its absence is among the most frequently cited findings in OCR enforcement. Also in scope: administrative, physical and technical safeguards; the breach notification rule with its own timelines and thresholds; business associate agreements down the chain to subcontractors; and the minimum necessary standard applied to access.

The medical device and health technology concentration around Thousand Oaks and Camarillo means this frequently arrives alongside 21 CFR Part 11 obligations, and the two are worth mapping together rather than running as separate programmes.

Data mapping, where the work actually is

Every obligation above depends on knowing what you hold. Building that inventory is unglamorous and takes longer than clients expect.

It runs through systems and databases, SaaS applications (discovered through expense analysis and SSO logs rather than by asking, because the answer to asking is always incomplete), marketing and analytics tooling (a persistent source of undisclosed data sharing) HR and payroll systems, support ticketing, backups and archives, and the spreadsheets and exports sitting on individual laptops that no formal inventory ever captures.

For each: what is collected, why, on what basis, how long it is kept, who it is disclosed to, and where it physically resides. Companies routinely discover during this exercise that they are sharing data with advertising platforms in ways that meet the statutory definition of "selling" or "sharing", which triggers opt-out obligations nobody had implemented.