What is CPRA?
The California Privacy Rights Act (CPRA), which came into effect on January 1, 2023, is an amendment to the California Consumer Privacy Act (CCPA). It enhances consumer privacy rights and imposes stricter requirements on businesses that collect, process, and share personal data of California residents. The CPRA introduces new rights, expands existing ones, and establishes the California Privacy Protection Agency (CPPA) to enforce the law.
The CPRA emphasizes six core consumer privacy rights:
Right to Know what personal information is being collected and how it is used and shared
Right to Delete personal information collected by the business
Right to Correct inaccurate personal information
Right to Opt-Out of the sale or sharing of personal information
Right to Limit Use and Disclosure of sensitive personal information
Right to Access collected data in a portable format
Additionally, the CPRA places a strong focus on sensitive personal information, including data like precise geolocation, health data, financial account information, and racial or ethnic origin. Consumers have the right to limit how such data is used and disclosed.
The law also requires businesses to implement reasonable security measures, perform regular risk assessments for high-risk data processing activities, and ensure that third parties and service providers meet similar obligations.
How does SecuPi enable CPRA Compliance?
SecuPi provides a data-centric platform that helps organizations meet CPRA compliance requirements quickly and effectively across hundreds of applications—without code changes and in a matter of days.
SecuPi supports CPRA compliance through:
Data Discovery & Mapping: Identifying where personal and sensitive information resides across applications and environments
Access Monitoring & Auditing: Tracking and logging who accesses personal data, when, and for what purpose, supporting the Right to Know and Right to Access
Policy-Based Controls: Enforcing fine-grained access controls and consent-based restrictions on personal and sensitive data
Right to Delete & Correct: Providing mechanisms for honoring data subject requests, including secure deletion or correction of personal data without impacting system integrity
Opt-Out Management: Enabling real-time enforcement of opt-out preferences regarding the sale or sharing of data
Limiting Sensitive Data Use: Applying access restrictions and usage policies on sensitive personal information to meet CPRA requirements
By integrating seamlessly with existing systems and applications, SecuPi significantly reduces the time, cost, and complexity of achieving and maintaining CPRA compliance.