# The CISO’s Guide to CPRA

## Introduction
Since the California Consumer Privacy Act (CCPA) went into effect on January 1, 2020, millions of Californians have exercised their privacy rights under this law. As complicated as the original CCPA was, changes to California’s state privacy law through the Privacy Rights Act (CPRA) (effective January 1, 2023) add further complexities. As the newly created California Privacy Protection Agency (CPPA) continues to work through delayed rules and guidelines (CPRA Regulations), many companies and their security executives are left wondering about next steps.

In this guide, we unpack the most important changes with the CPRA and explore how you can best prepare your privacy and data protection program. On November 3, 2020, Californians voted to pass Proposition 24, the California Privacy Rights Act (CPRA), expanding and strengthening the California Consumer Privacy Act (“CCPA”). Aligning closely with the GDPR, the CPRA – also known as CCPA 2.0 – introduces more stringent rules around the personal data businesses collect, store, use and disclose for a variety of business-operational or commercial purposes. Notably, the CPRA ends a temporary reprieve exempting employment and business contact data from most compliance obligations. Come January, the full scope of the enhanced privacy law will apply to all Californians’ personal information—including all employees that are residents of California.

Further, the CPRA introduces European-style data minimization and use limitation principles, an explicit definition of “sensitive personal information” subject to additional prescriptive notice and opt-out obligations, and establishes the need for regular privacy impact and cybersecurity assessments.

## Changes with CPRA
### Application Scope
- More than $25M in annual gross revenue (generated anywhere, not just in California)  
- More than 100K consumers, households, or devices in their database  
- At least half annual income from selling or exchanging customers’ personal information

### Key Impacts
1. **Costs related to data breaches and data privacy will increase**  
   CPRA may increase the financial and reputational cost of data breaches by expanding the CCPA’s private right of action to include email. With a well-funded enforcement agency (CPPA) in place, the enforcement will drive up the number of penalties.  
2. **California employees have privacy rights, requiring an audit of HR systems**  
   CCPA employee data exemptions will expire on Jan. 1, 2023. With the CPRA giving all Californians new and strengthened existing privacy rights, which means security teams will benefit from centralized visibility into the internal and third-party systems containing workforce information.  
3. **Increased protections around “sensitive personal information”**  
   CPRA defines “sensitive personal information (SPI)” as requiring heightened protection, which means security teams will need to work with privacy teams to prioritize reviews of SPI-holding systems.  
4. **Regulators expected to enforce privacy risk assessments**  
   CPRA will require privacy (and cybersecurity) risk assessments, so security teams should prepare for cross-functional reviews of new or changes in existing business activities.  
5. **Data retention and governance becomes more important**  
   CPRA will drive data minimization, on principle, and because of an enhanced look-back provision. Well-calibrated retention and disaster recovery policies can help reduce your attack surface.  
6. **Control over where personal data lives is more important than ever**  
   CPRA will encourage security and privacy teams to uncover hidden data flows, which can reduce hazardous blind spots. Data mappings (and RoPAs) benefit security and procurement teams too.

## Conclusion
With the adoption of the CPRA, organizations need to adapt swiftly to comply with these changes, enhance data governance practices, and prepare to meet the new requirements for protecting personal information.