Data Strategy Briefing — California Privacy Rights Act Effective Date

The California Privacy Rights Act (CPRA) entered into effect on 1 January 2023, amending the CCPA by expanding consumer rights, restricting sensitive data processing, and establishing the California Privacy Protection Agency (CPPA). Although enforcement is staged, organizations must operationalize minimization, purpose limitation, and contracting updates to avoid penalties and private actions.

What changed

• New rights include correction of inaccurate data and restrictions on sensitive personal information processing.
• Businesses must provide updated notices, honor opt-out signals for cross-context behavioral advertising, and execute revised contracts with service providers and contractors.
• The CPPA gained authority to issue regulations and enforce obligations alongside the Attorney General.

Why it matters

• Data inventories must identify sensitive personal information and map sharing/selling activities to support opt-out and limitation rights.
• Contracts and vendor assessments need updates to reflect CPRA definitions of service provider, contractor, and third party, including audit and remediation terms.
• Global programs should align CPRA controls with GDPR and other U.S. state laws to reduce fragmentation and litigation exposure.

Action checklist

• Refresh privacy notices, consent banners, and preference centers to capture CPRA-sensitive data choices and global privacy control signals.
• Update data processing agreements and vendor assessments to incorporate CPRA-specific obligations and audit mechanisms.
• Enhance data minimization practices by defining purpose limitations and retention schedules for each data category, documenting enforcement.

Related briefings

Curated signals from the same pillar or overlapping topics.

Data Strategy · Credibility 40/100 · January 1, 2023

Data Strategy Briefing — California Privacy Rights Act takes effect

The California Privacy Rights Act became effective on 1 January 2023, expanding consumer rights and imposing new obligations on businesses and service providers ahead of enforcement by the CPPA.

Data Strategy · Credibility 86/100 · October 1, 2022

Data Strategy Briefing — Japan APPI Cross-Border Transfer Rules Enforced

Japan enforced the amended Act on the Protection of Personal Information on 1 October 2022, requiring fuller disclosure and monitoring for cross-border transfers plus mandatory breach notification to the PPC.

Data Strategy · Credibility 40/100 · August 11, 2023

Data Strategy Briefing — India Digital Personal Data Protection Act Assent

India's President gave assent to the Digital Personal Data Protection Act on 11 August 2023, establishing a national consent-led privacy regime, cross-border transfer controls, and penalty framework that organizations…

Data Strategy · Credibility 40/100 · April 17, 2023

Data Strategy Briefing — April 17, 2023

Vietnam’s Decree 13/2023/ND-CP establishes a comprehensive personal data protection regime with stringent consent, localisation, and cross-border transfer obligations enforced by the Ministry of Public Security.

Data Strategy · Credibility 40/100 · September 1, 2022

Data Strategy Briefing — September 1, 2022

China’s Measures for Security Assessment of Data Exports took effect on 1 September 2022, making CAC-led reviews mandatory for important data and large personal data transfers and triggering a 30 November rectification…

Continue in the Data Strategy pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

• Data Interoperability Engineering Guide — Zeph Tech

  Engineer interoperable data exchanges that satisfy the EU Data Act, Data Governance Act, European Interoperability Framework, and ISO/IEC 19941 portability requirements.

• Data Stewardship Operating Model Guide — Zeph Tech

  Establish accountable data stewardship programmes that meet U.S. Evidence Act mandates, Canada’s Directive on Service and Digital, and OECD data governance principles while…

• Data Strategy Operating Model Guide — Zeph Tech

  Design a data strategy operating model that satisfies the EU Data Act, EU Data Governance Act, U.S. Evidence Act, and Singapore Digital Government policies with measurable…