The California Privacy Rights Act (CPRA) is a state-wide data privacy bill passed into legislation in 2020 - with the goal of safeguarding and protecting the personal data privacy of residents of California. CPRA is the result of a ballot initiative supported by a data privacy advocacy group called Californians for Consumer Privacy. CPRA adds more elements to CCPA to make it more comprehensive and far-reaching. CPRA will come into effect from January 1st, 2023.

Does CPRA apply to me?

CPRA applies to your organization if it - 1. Generates 25 Million dollars in gross revenue. 2. Has more than 100,000 consumers in California. 3. Derives more than 50% of the revenue from the sharing of personal data. If your organization meets the above three criteria, then CPRA would apply irrespective of where your organization is physically located or registered. CPRA does not apply to Non-Profits

Does CPRA apply to Non-Profits?

No. Non-profits are exempt from CPRA enforcement.

How can I make sure that my Salesforce is CPRA compliant?

CRM systems such as your Salesforce Org may contain personal data of your prospects, customers, employees, and partners. To ensure CPRA compliance, you can standardize, automate and enforce CPRA-specific requirements with Cloud Compliance’s Apps that are available from AppExchange. Some common use cases where Salesforce customers use our Apps include: Generate a personal data inventory and conduct Data Protection Impact Assessments (DPIA) ( Use our Personal Data Discovery) Automate Data Portability, Right To Be Forgotten (RTBF), and other Subject Access Requests (SAR) ( Use our Privacy Rights Automation ) Mask Sandbox Data to Enforce Data Security ( Use our Sandbox DataMasker ) Drive transparency and audit-readiness in your privacy disclosures ( Use our policy & Notice Management ) Solve consent fragmentation with an enterprise-wide consent and communication preference repository in your Salesforce org ( Use our Consent Management ) Orchestrate processing of RTBF & portability DSARs across all Salesforce Orgs (Prod. link)

What’s the difference between GDPR and CPRA/CCPA?

GDPR is the framework legislation of Europe while CCPA & CPRA are the framework legislations of California. The essence of both these laws is the same - to protect the data privacy of their respective constituents. GDPR applies to EU residents while CPRA/CCPA applies to Californian residents. They do differ in terms of their requirements also. Please refer to this short video for additional information.