CPPA cheat sheet

Personal data (GDPR Art. 4(1)): any information relating to an identified or identifiable natural person; identifiability includes singling out by identifiers, location data, or online identifiers.

Processing (Art. 4(2)) covers any operation on personal data: collection, recording, storage, alteration, retrieval, consultation, disclosure, erasure, destruction - automated or manual.

Special categories (Art. 9): racial/ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, sex life or sexual orientation.

Roles: controller determines purposes and means; processor processes on the controller's behalf; joint controllers share determination (Art. 26) and are jointly liable for the processing.

Pseudonymisation reduces linkability but data remains personal; anonymisation must be irreversible given all means reasonably likely to be used (recital 26 test).

Personal data breach (Art. 4(12)): a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Data minimisation, purpose limitation, storage limitation, accuracy, integrity/confidentiality, lawfulness/fairness/transparency, and accountability are the seven GDPR principles (Art. 5).

Consent must be freely given, specific, informed, unambiguous; silence, pre-ticked boxes, or inactivity do not constitute consent (Art. 4(11), Art. 7).

GDPR applies extraterritorially (Art. 3) when an EU/EEA controller/processor is involved, or when offering goods/services to, or monitoring the behaviour of, EU data subjects.

CCPA/CPRA applies to for-profit businesses meeting one of: >$25M gross revenue, ≥100,000 consumers/households' data, or ≥50% revenue from selling/sharing personal information.

CCPA thresholds are adjusted every odd-numbered year for CPI; the revenue figure was raised to $26,625,000 effective 1 January 2025.

PIPL (China) requires separate consent for sensitive personal information, cross-border transfers, and public disclosure; large processors must appoint a data protection officer.

LGPD (Brazil) mirrors GDPR principles; ANPD is the supervisory authority; legal bases include consent, contract, legal obligation, legitimate interest, and credit protection.

Canada's PIPEDA applies to commercial activity; Quebec's Law 25 adds privacy-by-default, breach reporting, and explicit consent requirements.

US state laws (e.g., Virginia CDPA, Colorado CPA, Connecticut CTDPA) typically grant rights to access, correct, delete, portability, and opt out of targeted advertising, sale, and profiling.

APEC Cross-Border Privacy Rules (CBPR) is a voluntary certification framework; Global CBPR Forum now administers it.

Six GDPR lawful bases (Art. 6): consent, contract, legal obligation, vital interests, public task, legitimate interests - only one is needed per purpose; consent is not required if another basis applies.

Legitimate interests (Art. 6(1)(f)) requires a three-part test: legitimate interest, necessity of processing, and balancing against data subject rights.

Purpose limitation: data collected for one purpose may not be further processed incompatibly; compatible further processing (e.g., research, statistics) does not require a new basis.

Storage limitation requires defined retention periods tied to purpose; indefinite retention without justification breaches Art. 5(1)(e).

Accountability (Art. 5(2)) requires demonstrable compliance - records of processing (Art. 30), DPIAs (Art. 35), and documented policies.

DPIA required when processing is likely high risk: systematic monitoring, large-scale special category data, or new technologies (WP248 criteria - two or more triggers).

Privacy by design and by default (Art. 25) requires data protection embedded in processing and only necessary data processed by default.

Records of processing (Art. 30) required for organisations with ≥250 employees unless processing is not regular, likely to result in risk, or involves special categories.

GDPR rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), automated decision-making (Art. 22).

Response deadline is one month from receipt, extendable by two further months for complex requests; extension must be communicated within the first month.

Access requests are free of charge; a reasonable fee may be charged for manifestly unfounded or excessive requests, or the request refused.

Portability applies only to data provided by the data subject, processed by automated means, and based on consent or contract.

Erasure ('right to be forgotten') does not apply where processing is necessary for legal obligation, legal claims, freedom of expression, or public interest.

Valid consent requires a clear affirmative action; withdrawal must be as easy as giving consent, and withdrawal does not affect prior lawful processing.

Consent records must show who consented, when, what they were told, and how - for accountability (Art. 7(1)).

Children's consent: GDPR Art. 8 sets the age of digital consent at 16, with member states permitted to lower it to no less than 13.

DPO designation (Art. 37) is mandatory for public authorities, large-scale systematic monitoring, or large-scale special category processing; DPO reports to the highest management level.

DPO independence: no instructions on exercise of tasks, no conflict of interest; DPO may not hold a role determining purposes/means (e.g., head of marketing).

Accountability requires demonstrable measures: policies, training records, DPIAs, processor contracts, breach logs, and audit trails.

Art. 30 records of processing must include purposes, categories of data/subjects, recipients, third-country transfers, retention periods, and security measures.

Codes of conduct (Art. 40) and certification mechanisms (Art. 42) are voluntary accountability tools that can demonstrate compliance.

Privacy governance structure typically separates the DPO (oversight), privacy office (operations), and business owners (processing decisions).

Training and awareness programs must be role-based; records of completion support accountability evidence.

Board-level reporting: privacy risk should be escalated to executive/board level as part of enterprise risk management.

Art. 32 requires appropriate technical and organisational measures: pseudonymisation/encryption, confidentiality/integrity/availability/resilience, restoration ability, and regular testing.

Appropriateness considers state of the art, costs of implementation, nature/scope/context/purposes of processing, and risk likelihood/severity.

Encryption at rest and in transit is a recognised safeguard; key management must be separated from data storage.

Access control should follow least privilege and need-to-know; role-based access control (RBAC) is a common implementation.

Logging and monitoring: security event logs support detection and forensics; retention should align with legal and investigative needs.

Pseudonymisation (Art. 4(5)) keeps data personal but reduces risk; it does not remove GDPR obligations.

Processor security obligations (Art. 28(3)(c)) mirror Art. 32 and must be stated in the processing contract.

Regular testing (Art. 32(1)(d)) includes penetration testing, vulnerability scanning, and incident response exercises.

Controller notification to supervisory authority (Art. 33): within 72 hours of becoming aware, unless unlikely to result in a risk to rights and freedoms.

72-hour clock starts when the controller becomes aware, not when the incident began; phased notification is permitted if full details are not yet available.

Art. 34: notify data subjects without undue delay when the breach is likely to result in a high risk to rights and freedoms.

Art. 33(2): processors must notify the controller without undue delay after becoming aware of a personal data breach.

Art. 33(5): controllers must document all breaches - facts, effects, and remedial action - regardless of whether notification was required.

Notification to the authority must include nature of breach, DPO contact, likely consequences, and measures taken or proposed (Art. 33(3)).

Exceptions to data subject notification (Art. 34(3)): encryption rendered data unintelligible, subsequent measures eliminate high risk, or disproportionate effort (public notice instead).

Incident response phases: preparation, detection/analysis, containment, eradication, recovery, and post-incident review.

Art. 28(3) processing contract must include subject matter/duration, nature/purpose, type of data and subjects, controller obligations and rights, and processor obligations.

Sub-processor engagement requires prior written authorisation from the controller; the processor must flow down equivalent obligations (Art. 28(4)).

International transfers need a Chapter V mechanism: adequacy decision, standard contractual clauses (SCCs), binding corporate rules, or Art. 49 derogations.

Schrems II (CJEU 2020) invalidated Privacy Shield; SCCs remain valid but require a Transfer Impact Assessment (TIA) of third-country law and supplementary measures.

EU-US Data Privacy Framework (2023) provides an adequacy route for certified US organisations; certification must be current and cover the relevant data.

Art. 49 derogations are for occasional, non-repetitive transfers; they are not a sustainable basis for systematic transfers.

Vendor risk management should include due diligence, contractual controls, ongoing monitoring, and audit rights.

Emerging tech risk: AI/automated decision-making triggers Art. 22 rights and DPIA obligations; biometric and location data are high-risk categories requiring extra controls.