Data Strategy Briefing — August 20, 2025

Executive briefing: California Senate Bill 362 (Delete Act) mandates that the California Privacy Protection Agency (CPPA) launch a centralized deletion system by January 1, 2026. Registered data brokers must connect to the platform, honour verified deletion requests within 45 days, and certify compliance annually starting in 2026. Organisations that sell or license personal data should complete technical integrations, evidence identity verification procedures, and prepare for expanded enforcement powers that include monetary penalties for non-compliance.

Key data strategy checkpoints

• Broker inventory. Catalogue all business units engaging in data brokerage under California Civil Code Section 1798.99.80 and ensure 2025 registrations reflect the CPPA-administered registry.
• Deletion orchestration. Build workflows to propagate Delete Act requests across internal systems and downstream partners, documenting completion evidence.
• Identity proofing. Implement robust verification to prevent fraudulent deletion requests while respecting the Act’s limits on additional consumer data collection.

Operational priorities

• API integration. Align engineering teams with CPPA technical specifications for the deletion mechanism and rehearse sandbox testing once available.
• Certification preparation. Draft annual compliance attestations covering process controls, third-party oversight, and record retention to submit beginning in 2026.
• Cross-jurisdiction alignment. Harmonise Delete Act responses with CCPA/CPRA, Virginia, and Colorado deletion obligations to avoid conflicting suppression lists.

Enablement moves

• Educate commercial and product teams on restrictions against selling the personal data of minors, which tighten under the Delete Act.
• Establish KPIs for deletion request turnaround time, error rates, and partner confirmations, reporting them to executive privacy steering committees.

Sources

• California SB 362 — Delete Act
• CPPA: Data broker registration and Delete Act implementation
• Perkins Coie: California enacts Delete Act

Zeph Tech unifies global deletion operations, integrating California’s centralized mechanism with identity proofing and suppression governance across marketing ecosystems.

Related briefings

Curated signals from the same pillar or overlapping topics.

Data Strategy · Credibility 50/100 · August 22, 2025

Data Strategy Briefing — August 22, 2025

With the EU Data Act becoming applicable on 12 September 2025, data leaders have weeks left to operationalize user-initiated portability, shared data space contracts, and compensation models that withstand Article 4…

Data Strategy · Credibility 40/100 · August 26, 2025

Data Strategy Briefing — August 26, 2025

Large EU groups subject to the CSRD must digitally tag FY2025 sustainability statements under the European Single Electronic Format. Digital reporting remains unaffected by the EU’s 2025 simplification proposals; once…

Data Strategy · Credibility 85/100 · September 12, 2025

Data sharing governance — Data Act public-sector access obligations

From 12 September 2025, data holders must respond to EU public-sector requests made under the Data Act’s exceptional-need provisions, requiring legal, security, and engineering teams to codify intake and extraction…

Data Strategy · Credibility 50/100 · September 20, 2025

Data Strategy Briefing — September 20, 2025

Kentucky’s Consumer Data Protection Act takes effect on January 1, 2026, giving privacy teams one quarter to finalise data inventories, universal opt-out handling, and assessments for high-risk processing.

Data Strategy · Credibility 89/100 · September 24, 2025

Data Strategy Briefing — September 24, 2025

The European Commission must deliver its first Data Governance Act evaluation by 24 September 2025, so data leaders should prepare evidence packs that show how neutrality, access, and sanction frameworks are operating…

Continue in the Data Strategy pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

• Data Interoperability Engineering Guide — Zeph Tech

  Engineer interoperable data exchanges that satisfy the EU Data Act, Data Governance Act, European Interoperability Framework, and ISO/IEC 19941 portability requirements.

• Data Stewardship Operating Model Guide — Zeph Tech

  Establish accountable data stewardship programmes that meet U.S. Evidence Act mandates, Canada’s Directive on Service and Digital, and OECD data governance principles while…

• Data Strategy Operating Model Guide — Zeph Tech

  Design a data strategy operating model that satisfies the EU Data Act, EU Data Governance Act, U.S. Evidence Act, and Singapore Digital Government policies with measurable…