CCPA template · CCPA and CPRA
Security Practices Policy
Reasonable security measures required to protect personal information and avoid CCPA private right of action for data breaches. Written for your company, citing the controls below.
- Sections
- 7
- Controls cited
- 6
- Formats
- PDF, Word
- Shelf
- 8 CCPAdocuments in all
No card needed to start.
CCPA7 sections
Security Practices PolicyReasonable security measures required to protect personal information and avoid CCPA private right of action for data breaches.
- Cites
- §1798.150, SOC 2 CC5.1, SOC 2 CC6.1 and 3 more
- Formats
- PDF and Word
CCPA shelf
Sections
Each written around your company: your tools, your roles, your review dates.
- Purpose and Scope
- Reasonable Security Standard
- Access Controls
- Encryption Requirements
- Incident Response and Breach Notification
- Security Risk Assessments
- Employee Security Controls
Controls it cites
The CCPA controls first, then the matching controls in other frameworks.
- §1798.150§1798.150: Private Right of ActionCCPA
- SOC 2 CC5.1COSO Principle 10: Control ActivitiesSOC 2
- SOC 2 CC6.1Logical & Physical Access: Security SoftwareSOC 2
- ISO A.5.1Policies for Information SecurityISO 27001
- GDPR Art. 32Security of ProcessingGDPR
- CSF PR.PS-1Platform SecurityNIST CSF
- CCPA7 sections
Employee Privacy Training Policy
Cites§1798.130 SOC 2 CC1.4 ISO A.6.3 +3 +4PDF · WordCites §1798.130, §1798.130: Notice & Response Requirements (CCPA); SOC 2 CC1.4, COSO Principle 4: Competence Commitment (SOC 2); ISO A.6.3, Information Security Awareness & Training (ISO 27001), and 3 more. - CCPA9 sections
Privacy Notice / Privacy Policy
Cites§1798.100 §1798.110 §1798.115 +4 +5PDF · WordCites §1798.100, §1798.100: Consumer Right to Know (CCPA); §1798.110, §1798.110: Right to Know Categories (CCPA); §1798.115, §1798.115: Right to Know Disclosures (CCPA), and 4 more. - CCPA9 sections
Consumer Rights Procedures
Cites§1798.100 §1798.105 §1798.106 +4 +5PDF · WordCites §1798.100, §1798.100: Consumer Right to Know (CCPA); §1798.105, §1798.105: Right to Delete (CCPA); §1798.106, §1798.106: Right to Correct (CCPA), and 4 more. - CCPA7 sections
Data Inventory & Mapping Policy
Cites§1798.100 §1798.110 §1798.121 +3 +4PDF · WordCites §1798.100, §1798.100: Consumer Right to Know (CCPA); §1798.110, §1798.110: Right to Know Categories (CCPA); §1798.121, §1798.121: Right to Limit SPI Use (CCPA), and 3 more. - CCPA7 sections
Opt-Out & Do Not Sell/Share Policy
Cites§1798.120 §1798.135 §1798.121 +2 +3PDF · WordCites §1798.120, §1798.120: Right to Opt-Out of Sale (CCPA); §1798.135, §1798.135: Opt-Out Links & GPC (CCPA); §1798.121, §1798.121: Right to Limit SPI Use (CCPA), and 2 more. - CCPA7 sections
Data Retention & Deletion Policy
Cites§1798.105 §1798.130 GDPR Art. 5 +3 +4PDF · WordCites §1798.105, §1798.105: Right to Delete (CCPA); §1798.130, §1798.130: Notice & Response Requirements (CCPA); GDPR Art. 5, Principles of Processing (GDPR), and 3 more.
CCPA on its own
- Documents
- 8
- Plan
- Growth
- Price
- $199 a month or $1,990 a year
Growth also covers HIPAA, so CCPA + HIPAA stays at $199 a month. Two frameworks besides HIPAA need Scale.
Your first policy is free. No card needed to start.