If your organization does business in California and meets a statutory threshold, the California Consumer Privacy Act applies to personal information you collect from California residents.
The California Privacy Rights Act amended that law. ALCON DTS helps you inventory the systems, vendors, and requests that sit under it. Counsel still decides whether you are a covered business.
The California Consumer Privacy Act gives California residents rights over personal information a covered business collects. Those rights include knowing what is collected, correcting it, deleting it, and opting out of sale or sharing. The California Privacy Rights Act expanded the law. The California Privacy Protection Agency writes regulations and enforces them.
The statute is the duty. A privacy policy on the website is the notice. The systems and the vendor list are what make the notice true.
It covers personal information collected from California residents. That includes names, contact details, commercial records, online identifiers, and sensitive categories the statute lists.
It does not replace HIPAA for patient information. It does not replace PCI DSS for payment cards. It does not tell a firm that misses every threshold to build a full consumer request desk. Counsel makes that call.
It can apply if you are a for-profit business, you do business in California, and you collect personal information from California residents, and you meet one of these:
A firm under those lines can still owe contract terms when it discloses personal information to a vendor. Confirm the current revenue figure and your status with counsel before you treat the law as yours.
A covered business needs a notice that matches collection, a way to take and verify requests, and a record of what was done. The IT side of that work is the inventory, the access path, the deletion path, and the vendor list.
You keep counsel and the coverage decision. We run the controls on the systems we support and keep the evidence with you.
| CCPA element | What ALCON DTS provides |
|---|---|
| Inventory | Where personal information sits on the systems we support, including mail, files, and backups |
| Access and deletion | A path to find, export, or remove a person’s information on those systems when counsel confirms the request |
| Vendors | A list of providers that receive personal information, and where the contracts are filed |
| Notices and the site | Coordination so the public notice matches the systems in use |
| Opt-out | Technical support for a site control when sale or sharing is actually happening |
| Evidence file | The inventory, request log, and vendor list counsel or a regulator asks to see |
The exact controls depend on the plan and any project work. The review shows what is in place and what would close a gap.
Need a clear picture of California privacy duties? A review looks at whether California residents’ information is on the systems you run, and what counsel still has to decide.
HIPAA still governs patient information. See our HIPAA Security Risk Analysis and Business Associate Agreements Under HIPAA guides.
PCI DSS still governs payment cards. See PCI DSS for Merchants.
Other states have their own privacy laws. California is the one this page explains. A later guide can map the shared pattern.
A review of your needs and growth plans looks at whether California residents’ information is on the systems you run, and what counsel still has to decide. You keep the legal call. We keep the inventory and the evidence file with you.
Managed IT, cybersecurity, and compliance for Central Texas since 2001.
© 2026 ALCON DTS.
