January 1, 2020, represents the start of a new era of privacy regulations with the launch of the California Consumer Privacy Act (CCPA). With less than a month to go, some companies are still scrambling to understand their data practices and implement new technology or process measures to help address the key requirements of the CCPA.
The California Attorney General’s office published regulations that provide guidance on complying with Data Subject Access Requests (DSARs), a critical feature of the CCPA that allows consumers the right to know what personal information an organization holds on them, request deletion of their data, and request the right to opt-out of the sale of their data. The regulations require that an organization offer two methods for consumers to submit those requests, and one of those must reflect how the business primarily interacts with consumers (an online portal, a paper form, or a toll-free number, for example). Basically, the law was designed to make it easy for consumers to request their data.
