Can your data inventory answer a CCPA request to know?

A CCPA request to know can come from a former employee, a job applicant or a prospect on your mailing list as easily as from a client. Once it arrives, someone at your firm has 45 calendar days to find what you hold about that one person across email, file shares, HR and payroll systems and every vendor that touches the data. A data inventory built before the first request is what makes that deadline workable.

What does a CCPA request to know require you to produce?

A request to know can ask for two different things: the categories of personal information you hold about the person, or the specific pieces of it. Civil Code § 1798.110(a) gives consumers the right to learn the categories of personal information collected, the categories of sources, the business or commercial purpose, the categories of third parties who receive it, and the specific pieces collected about them.

The regulations add detail. Section 7024(k) of the CCPA regulations lists six items a business must provide in response to a verified request for categories, including the categories sold, shared or disclosed for a business purpose and to whom. Section 7024(j) requires "an individualized response" and generally does not allow a business to answer by pointing to its privacy policy. A privacy policy describes the firm. A request to know asks about one person.

The lookback is longer than many firms assume. Under Civil Code § 1798.130(a)(2)(B) and regulation section 7024(h), a response covers the 12 months before the request, and a consumer may ask for personal information collected earlier, back to January 1, 2022. The business must provide it unless that is impossible or would involve disproportionate effort, and it must explain why in detail if it makes that claim. The response includes personal information your service providers and contractors collected under contract with you, and section 7024(i) requires them to help.

How long do you have to respond?

You must confirm receipt within 10 business days and respond within 45 calendar days. Those deadlines come from regulation section 7021 and Civil Code § 1798.130(a)(2)(A). You may extend once by another 45 calendar days, for a maximum of 90, if you tell the consumer within the first 45 days and explain why.

Forty-five days is enough time to search systems you already know about. It is too little time to discover where personal information lives, ask vendors what they hold and work out who owns each system. That discovery work is what a data inventory is for, and it needs to be done before the first request arrives.

Does the CCPA reach a financial firm's data?

Yes, but only for data the Gramm-Leach-Bliley Act does not cover. Civil Code § 1798.145(e) exempts personal information collected, processed, sold or disclosed under the Gramm-Leach-Bliley Act. The exemption attaches to the data itself. For an RIA, broker-dealer or insurance agency that meets the CCPA's thresholds, client financial records may be exempt while employee and applicant records, website visitor data, event registrations and prospect lists are not. The CCPA's temporary exemptions for employee and business-to-business data became inoperative on January 1, 2023.

That makes tagging essential. An inventory that cannot separate GLBA-covered data from data the CCPA reaches will either over-disclose or miss records it should have searched. The same tagging helps law firms, accounting firms and nonprofits that hold a mix of client, staff and donor or marketing data.

Two related guides go deeper: whether the CCPA GLBA exemption covers your whole firm and how to refresh your employee privacy notice. SEC-registered firms can reuse the same system list for their Reg S-P sensitive customer information data map.

What fields does a CCPA data inventory need?

The inventory needs one row per system or storage location, with fields that map to what a response must contain:

• System or location: Microsoft 365 mailboxes, file shares, CRM, HR and payroll platform, client portal, marketing platform, paper files.
• Whose data it holds: clients, employees, applicants, prospects, website visitors, donors.
• Categories of personal information, using the CCPA's categories so answers line up with your privacy policy.
• Source of the data and the business purpose for collecting it.
• Who receives it: service providers and contractors, third parties, and whether any of it is sold or shared.
• How to search it for one person, and by which identifier: name, email address, phone number or account number.
• Retention period, backup locations and how long backups are kept.
• Sensitive elements that may not be disclosed in a response.
• Whether the data is GLBA-covered or within CCPA scope.
• The person who runs the search and the vendor contact who answers for any service provider data.

The search field does most of the work. Categories can be answered from the inventory alone. Specific pieces require someone to pull records for one person from each system, and if nobody knows how to search a system by name or email, the 45-day clock runs while they figure it out.

Do you have to search archives and scanned files?

Usually yes. The regulations excuse a search only in narrow cases. Under section 7024(c), a business need not search for personal information if all four conditions hold: it is not kept in a searchable or reasonably accessible format, it is kept solely for legal or compliance purposes, it is not sold or used for any commercial purpose, and the business tells the consumer which categories of records it did not search. Archived email kept for business use, or a shared drive full of scanned intake forms, usually fails at least one of those tests.

Backups need their own entry. For deletion requests, section 7022(d) lets a business delay deleting data on archived or backup systems until that system is restored or next accessed or used. The inventory should record where backups are kept and for how long, so the response can say so accurately.

What must stay out of a CCPA access response?

Certain data elements may never be disclosed in response to a request to know. Section 7024(d) bars disclosing a Social Security number, driver's license or other government identification number, financial account number, health insurance or medical identification number, account password, security questions and answers, or unique biometric data. The business must instead tell the consumer it holds that type of information, described with enough particularity to be useful.

This matters most for financial firms, accounting firms and employers, whose systems are full of exactly these elements. Flagging them in the inventory tells whoever compiles a response what to withhold and describe, which keeps a privacy request from turning into a data exposure.

What should you do this quarter to prepare for a request to know?

• Start with the three systems that hold the most personal information and fill in every field above.
• Run a mock request on a willing employee and time it from receipt to a finished response.
• Confirm that service provider contracts require help with consumer requests and that you know who to ask at each vendor.
• Tag GLBA-covered data separately from data the CCPA reaches.
• Record where Social Security numbers and account numbers are stored so responses can withhold and describe them.
• Add an inventory update step to your process for approving new applications, including AI tools.
• Ask counsel to confirm whether the CCPA applies to your firm and which of your data is exempt.

How does s90 help with the technical side?

Most of an inventory's hard facts are technical: which systems exist, where they store data, which vendors connect to them and where backups go. As the managed IT provider for compliance-focused firms, s90 can supply that system-level picture and keep it current as applications are added or retired, so your privacy lead can focus on the categories, purposes and responses. If a request to know would send your team hunting, we are happy to help you map it out first.