Data mapping is the most important step in becoming CCPA compliant, as it forms the foundation for every other part of the process. Here is what you need to do to create a thorough and reliable data map for your business.
The CCPA’s definition of personal information is expansive, and businesses often collect more of it than they realize.
Check with every department to understand where they collect information.
By putting consumers into groups, it’s easier to know what personal information is being collected and how it is used. This also helps with responding to privacy requests.
Names, email addresses, transaction history, IP addresses, etc.
Some of the personal information you collect may be exempt from CCPA (e.g., publicly available information, HIPAA medical information, and more).
Sales and marketing, providing goods and services, technical maintenance, etc.
This will make it much easier to respond to consumers’ privacy requests.
The CCPA requires businesses to implement reasonable security procedures to protect consumers’ personal information.
The law’s definition of selling personal information covers many non-monetary transactions, such as receiving a discount on software. Sharing means using personal information for cross-context behavioral advertising (interest-based advertising).
This should cover everything from credit card processors to Google and Facebook.
Determine whether they are third parties or potentially exempted as CCPA service providers or contractors, then categorize the parties (IT infrastructure, data analytics, etc.).
Advertising services, payment processing, etc.
Every disclosure to third parties should be examined to determine if the business receives some valuable consideration in exchange. Learn more about this in Step 3: Vendor Classification.
The CCPA’s rules are complex, and businesses are collecting more personal information than ever. TrueVault simplifies the process of data mapping by providing automated, step-by-step guidance from start to finish. Contact our team today.
Disclaimer: This content is provided for general informational purposes only and does not constitute legal advice. This content is not a substitute for obtaining legal advice from a licensed attorney. The information on this page may be changed without notice and is not guaranteed to be complete, correct or up-to-date, and may not reflect the most current legal developments.