We are a B2B company and do not sell to consumers. Are we still covered?

Probably, and this is the provision that surprises B2B teams most. California is the only state consumer privacy law that treats employees, job applicants, and business contacts as consumers. Collect a name and email at a trade show from someone who lives in California, or employ people there, and that data counts toward your thresholds and carries the same rights as customer data.

We already comply with the GDPR. Is that enough?

No, though it puts you well ahead. The scopes differ, the rights differ, and the mechanics differ. The right to limit the use of sensitive personal information has no direct GDPR equivalent, opt-out preference signals like Global Privacy Control are a California construct with no GDPR counterpart, and California’s coverage of employee and B2B contact data is broader than most GDPR programs were built for.

Does the CCPA apply to nonprofits?

Generally not. The CCPA applies to for-profit businesses, so most nonprofits fall outside it. You can still be pulled in indirectly, as a service provider handling a covered business’s data under contract, or where a covered business controls you or you share branding with one.

What is exempt from the CCPA?

Exemptions mostly focus on the data rather than the organization. Certain HIPAA-regulated health information, some Gramm-Leach-Bliley and Fair Credit Reporting Act data, and some clinical-trial data are carved out. Being a HIPAA-covered or GLBA-regulated business does not put your whole company outside the CCPA, only the specific regulated data.

Do we need a data protection officer?

No. The CCPA has no equivalent of the GDPR’s DPO requirement. What it does have is a 10-business-day acknowledgment clock and a 45-day response clock, which means somebody has to own the inbox and the workflow behind it.

Is our SOC 2 report enough for the Article 9 cybersecurity audit?

No, though it helps. The regulations let you reuse work from another audit or assessment, and the agency’s own position is that there is no one-to-one mapping. A SOC 2 boundary typically excludes systems the Article 9 audit covers, such as HR and applicant tracking, and a Security-only SOC 2 says nothing about several of the components Article 9 requires.

Author: Meeba Gracy

Meeba, an ISC2-certified cybersecurity specialist, passionately decodes and delivers impactful content on compliance and complex digital security matters. Adept at transforming intricate concepts into accessible insights, she’s committed to enlightening readers. Off the clock, she can be found with her nose in the latest thriller novel or exploring new haunts in the city.

ccpa-compliance-2026-requirements-thresholds-updates

Blogs, CCPA

CCPA Compliance in 2026: Requirements, Thresholds, and Updates

TL;DR California has settled eight CCPA enforcement actions since 2022, seven of them since July 2025. The most recent, against General Motors in May 2026, was $12.75 million, nearly five times the largest that came before it. CCPA compliance means giving California residents rights over the personal information you store, and it applies to any…