The CCPA DSAR Process

California Has Its Own Rules for Data Requests

If your business falls under the California Consumer Privacy Act, you are required to provide consumers with specific mechanisms to exercise their data rights. The CCPA DSAR process differs from GDPR-based requests in several important ways, and organizations managing multi-jurisdiction compliance need to understand the distinctions.

Key elements of the CCPA DSAR process include:

• Designated intake channels -- You must offer at least two methods for consumers to submit requests, including a toll-free phone number and a web-based option. Online-only businesses may use an email address instead of a phone number.
• Tiered identity verification -- The CCPA requires different levels of verification depending on the request type. Requests to know categories of data require a "reasonable degree of certainty" (two data points). Requests for specific pieces of data demand a higher standard (three data points plus a declaration under penalty of perjury).
• Response timelines -- You must acknowledge receipt within 10 business days and respond substantively within 45 calendar days, with one possible 45-day extension if you notify the consumer.
• Scope of disclosure -- CCPA responses must cover categories of data collected, sources, business purposes, third parties the data was shared with, and (when applicable) the specific pieces of personal information held.

For businesses already handling GDPR requests, the CCPA process requires its own documented procedures rather than a one-size-fits-all approach.

---

Build a CCPA-ready process from scratch. Download the DSAR Compliance Guide for a framework that covers both GDPR and CCPA requirements in one actionable document.