California privacy & data protection
California privacy law, in plain English.
What the law actually requires, and how to comply. Written by a California attorney for the businesses that handle personal information and the people who advise them. Every rule is linked to its official source.
Topics
Nine areas of California privacy compliance
Each guide explains the rules, links the statutes and regulations, and ends with a checklist.
Consumer privacy and consumer rights
Who the CCPA covers, the rights it gives consumers, and how to handle access, deletion, correction and opt-out requests.
Read the guideHealth information confidentiality
HIPAA and California's Confidentiality of Medical Information Act, for healthcare and senior-care providers.
Read the guideEmployee data
Applicant and employee privacy: CCPA rights at work, personnel and payroll records, and medical information.
Read the guideVendor and service-provider contracts
The contract terms the CCPA and HIPAA require when vendors handle personal information for you.
Read the guideData sharing and data transitions
Sharing data with others, and moving it when you switch providers, close a practice or sell a business.
Read the guideSecurity policies and controls
California's reasonable-security duty, the HIPAA Security Rule, and CalPrivacy's cybersecurity audit rules.
Read the guideData breaches
Incident response, notice deadlines, what the notice must say, and when to tell the Attorney General.
Read the guidePrivacy notices
What your privacy policy, notice at collection and opt-out links must say, and where they must appear.
Read the guidePrivacy in new products and technology
Privacy by design, risk assessments, automated decisionmaking, AI laws and website tracking tools.
Read the guide
By the numbers
The figures to know
Current as adjusted for inflation on January 1, 2025. The next adjustment is due January 1, 2027.
Annual gross revenue ($26,625,000) that brings a business under the CCPA, one of three tests.
Civ. Code § 1798.140(d)Maximum fine per intentional CCPA violation or violation involving minors.
Civ. Code § 1798.155Maximum statutory damages per consumer per incident in a CCPA breach lawsuit.
Civ. Code § 1798.150Nominal damages a patient can recover under the CMIA without proving harm.
Civ. Code § 56.36(b)Guides
Start here
In-depth explainers on the questions businesses ask most.
- Law explainer
California's breach notice law after SB 446
The new 30-day deadline, the Attorney General filing, the encryption safe harbor, and exactly what the notice must say.
Data breaches - How-to
Responding to consumer privacy requests
Intake, verification, the 10-day and 45-day clocks, and why opt-outs follow different rules.
Consumer privacy - Comparison
CMIA vs. HIPAA: what California adds
Broader coverage, stricter forms, shorter deadlines, and a private right of action.
Health information - Explainer
Honoring Global Privacy Control
What changed on January 1, 2026, the Disney settlement, and the browser mandate coming in 2027.
Consumer privacy - Topic guide
The nine terms every service-provider contract needs
Without them, your vendor isn't a service provider, and the disclosure may be a sale.
Vendor contracts - Topic guide
Risk assessments and automated decisions
The CalPrivacy rules for AI and high-risk processing, with deadlines from 2027 to 2028.
Products and technology
On the calendar
What's next
Automated decisionmaking rules and browser opt-out signals
ADMT notices, opt-outs and access rights take effect; browsers must offer an opt-out preference signal.
Risk assessments for existing processing
Due for covered processing that began before 2026.
First filings with CalPrivacy
Risk-assessment submissions, and the first cybersecurity audit certifications for the largest businesses.
How DataDuty works
Built to be relied on
Primary sources
Rules are tied to the statute, regulation or agency guidance they come from, linked to the official government site.
Dated reviews
Every page shows when it was last reviewed, because California privacy law changes often.
Practical checklists
Each guide ends with steps you can act on, each tied to its legal source.
No tracking
This site uses no cookies, analytics or third-party scripts. Privacy policy.