The fourth and final part of this CCPA client alert series focuses on certain training and record-keeping requirements pursuant to the CCPA.

The California Consumer Privacy Act of 2018 (the “CCPA”) and the related proposed Attorney General Regulations (the “Regulations”) provide California consumers with increased privacy rights and protections with respect to their personal information. Businesses that are subject to the CCPA must comply with various notice obligations and requirements related to the collection, deletion and sale of personal information. The California Attorney General intends to begin enforcing the CCPA and the Regulations on July 1, 2020.

The CCPA and the Regulations set forth certain training and record-keeping obligations for businesses, including the following:

• All individuals responsible for handling consumer inquiries about a business’ privacy practices or the business’ compliance with the CCPA must be informed of all the requirements in the CCPA and the Regulations, as well as how to direct consumers to exercise their rights thereunder.
• A business must maintain records of consumer requests made pursuant to the CCPA and how the business responded to such requests for at least 24 months. The business must implement and maintain reasonable security procedures and practices in maintaining these records.
• If a business knows or reasonably should know that it buys, sells, receives or shares for commercial purposes the personal information of 10,000,000 or more consumers in a calendar year, it must disclose certain metrics regarding CCPA compliance in its privacy policy by July 1 of every calendar year.
• If a business meets the above 10,000,000 consumer threshold, it must also establish, document, and comply with a training policy to ensure that all individuals responsible for handling consumer requests pursuant to the CCPA or compliance with the CCPA are informed of the requirements in the CCPA and the Regulations.

This client alert provides a summary of certain training and record-keeping requirements pursuant to the CCPA and the Regulations.