Glossary of Compliance

Compliance Glossary

Our list of curated compliance glossary offers everything you to know about compliance in one place.

Glossary » CCPA » CCPA Data Subject Rights

CCPA Data Subject Rights

The California Consumer Privacy Act establishes a set of fundamental rights for the residents of California, known as data subjects concerning their personal information. These rights empower consumers with greater control over their data and increase transparency in how businesses handle their personal information. 

The key Data Subject Rights under the CCPA are:

Right to know: Consumers have the right to request that businesses disclose the categories and specific pieces of personal information collected about them, the sources of that information, the purpose for collecting or selling the information, and the categories of third parties with whom the information is shared. 

Right to delete: Consumers can request the deletion of their personal information collected by businesses, subject to certain exceptions such as completing transactions, detecting security incidents, or complying with legal obligations. 

Right to opt-out: Consumers have the right to direct businesses not to sell their personal information to third parties. Businesses must provide a clear and conspicuous “Do Not Sell My Personal Information” link on their website homepage to facilitate this right.

Right to non-discrimination: Businesses are prohibited from discriminating against consumers who exercise their CCPA rights. This includes denying goods or services, charging different prices, or providing a different quality of goods or services.

Right to access: Consumers can request access to their personal information free of charge, delivered by mail or electronically in a readily usable format that allows the consumer to transmit this information to another entity without hindrance.

Right to correct: Consumers have the right to correct inaccurate personal information that a business has about them.

Right to limit use:  Consumers have the right to limit the use and disclosure of sensitive personal information collected about them.

These Data Subject rights form the core of the CCPA’s consumer protection and aims to promote transparency, control, and accountability in the handling of personal information by businesses.

Additional reading

DSPM Tools

Top 10 DSPM Tools to Uncover and Secure Your Data

Fragmented data discovery, visibility gaps, and the tedious process of manually classifying data can spell trouble in a world that produces data at an unprecedented pace. In fact, 90% of the world’s data was generated just between 2021 and 2023, and by 2025, it’s expected to soar to 181 zettabytes. It’s no wonder data security…
How to write a VAPT report

How to write a VAPT report?

Leveraging data and data driven insights helps organizations improve their security and drive success. Data awareness empowers security teams to identify early signs of compromise, respond promptly, and tighten internal controls for the future. Vulnerability assessment and Penetration testing reports or VAPT reports, among other data sources, are crucial for gaining this situational awareness. The…
HIPAA Minimum Necessary Rule Standard

How to Comply with the HIPAA Minimum Necessary Rule

Much of the administrative simplification rule of HIPAA focuses on preventing unauthorized disclosure of protected health information (PHI). A good practice that helps to protect PHI is applying the HIPAA minimum necessary rule standard.  This article details what this rule entails, how it works, cases where it is not applicable, and what happens when you…

Sprinto: Your growth superpower

Use Sprinto to centralize security compliance management – so nothing
gets in the way of your moving up and winning big.