bmad-plus 0.7.5 → 0.9.0

package/src/bmad-plus/packs/pack-shield/references/ccpa/ccpa-gdpr-comparison.md

@@ -1,117 +1,117 @@
-# CCPA/CPRA vs. GDPR — Side-by-Side Comparison
-
-For organisations subject to both laws (e.g., a US company with EU customers, or an EU company with California customers), understanding the differences and overlaps is essential to building an efficient dual-compliance programme.
-
----
-
-## Scope & Applicability
-
-| Dimension | CCPA/CPRA | GDPR |
-|---|---|---|
-| **Jurisdictional trigger** | Doing business in California | Processing EU/EEA/UK residents' personal data |
-| **Who is covered** | For-profit businesses meeting threshold criteria | Any controller or processor, regardless of size or location |
-| **Size/revenue thresholds** | Yes — $25M revenue OR 100K+ consumers OR 50%+ revenue from PI sale/sharing | No — applies to any organisation processing EU personal data |
-| **Non-profits** | Generally exempt | Covered |
-| **Government entities** | Exempt | Covered (public authorities have specific rules) |
-| **B2B data** | Generally excluded (employee data limited exemption extended by CPRA) | Covered |
-
----
-
-## Key Definitions
-
-| Concept | CCPA/CPRA | GDPR |
-|---|---|---|
-| **Personal data/PI** | Broadly defined; includes household data | Broadly defined; personal to identified/identifiable individual only |
-| **Special/sensitive categories** | CPRA SPI: SSN, precise geolocation, biometric, health, racial/ethnic, religious, union, sexual orientation, genetic, credentials, comms content | Special categories: racial/ethnic, political opinion, religious, union, genetic, biometric, health, sex life, sexual orientation |
-| **Controller equivalent** | "Business" | "Controller" |
-| **Processor equivalent** | "Service Provider" + "Contractor" (CPRA) | "Processor" |
-| **Third party** | Entity that receives PI that is not a service provider/contractor | Not separately defined in same way |
-| **Sale of data** | Broad: monetary or other valuable consideration | No equivalent concept; disclosure to third party = separate processing activity |
-| **Sharing (cross-context behavioral advertising)** | CPRA-specific concept | No direct equivalent; covered under legitimate interests or consent for tracking |
-
----
-
-## Lawful Basis
-
-| Aspect | CCPA/CPRA | GDPR |
-|---|---|---|
-| **Basis for processing** | No lawful basis requirement — businesses can collect PI without consent (for most purposes) | Requires one of six lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests) |
-| **Consent for sensitive data** | Right to limit SPI use (opt-out model for most businesses) | Explicit consent required for special category data (with narrow exceptions) |
-| **Opt-in vs. opt-out** | Primarily opt-out model (consumers must affirmatively request opt-out) | Primarily opt-in model (consent must be freely given, specific, informed, unambiguous) |
-| **Minors (under 16)** | Opt-in required for sale/sharing of PI of consumers 13–16; parental consent under 13 | GDPR age of consent varies by Member State (13–16); parental consent for under-16 processing based on consent |
-
----
-
-## Consumer / Data Subject Rights
-
-| Right | CCPA/CPRA | GDPR |
-|---|---|---|
-| **Right to access** | Yes — specific pieces + categories (12-month scope pre-CPRA, no limit post-Jan 2022) | Yes — all personal data, no 12-month limitation |
-| **Right to delete** | Yes — with numerous exceptions | Yes (right to erasure) — with exceptions |
-| **Right to correct** | Yes (CPRA addition) | Yes (right to rectification) |
-| **Right to portability** | Yes — portable format in access request | Yes — explicitly structured, commonly used, machine-readable format |
-| **Right to opt-out of sale** | Yes — "Do Not Sell or Share My Personal Information" | No direct equivalent; may be covered by withdrawal of consent or objection to legitimate interests |
-| **Right to restrict processing** | Limited — SPI limitation right (CPRA) | Yes — broader right to restrict processing |
-| **Right to object** | Limited — opt-out of sale/sharing | Yes — right to object to processing based on legitimate interests or direct marketing |
-| **Automated decision-making** | Pending CPPA rulemaking; opt-out right likely | Yes (Art. 22) — right not to be subject to solely automated decisions with significant effects |
-| **Non-discrimination** | Yes (§1798.125) | No direct equivalent |
-| **Response deadline** | 45 days + 45-day extension; SPI limit: 15 business days | 1 month + 2-month extension |
-
----
-
-## Privacy Notices
-
-| Requirement | CCPA/CPRA | GDPR |
-|---|---|---|
-| **At-collection notice** | Yes — categories, purposes, whether PI is sold/shared, link to privacy policy | Yes — Art. 13/14 privacy notice at collection |
-| **Privacy policy** | Yes — comprehensive; updated annually | Yes — privacy notice must be accessible |
-| **Retention periods** | Yes (CPRA addition) | Yes (must be specified or criteria stated) |
-| **Lawful basis disclosure** | No — not applicable | Yes — must identify lawful basis for each processing purpose |
-| **GPC signal** | Must honor as valid opt-out | No equivalent; but ePrivacy Directive may cover browser signals |
-
----
-
-## Vendor / Third-Party Management
-
-| Aspect | CCPA/CPRA | GDPR |
-|---|---|---|
-| **Processor agreements** | Required with service providers and contractors | Required Data Processing Agreements (Art. 28) |
-| **Contract requirements** | Purpose limitation, prohibition on resale, deletion, audit rights | Detailed Art. 28 requirements: processing only on instructions, security, subprocessor rules, return/deletion |
-| **Sub-processor** | Contractor / downstream service provider must also comply | Subprocessors require DPA + controller notification/approval |
-| **International transfers** | No transfer restriction mechanism (CCPA does not restrict cross-border transfers) | Restricted to adequate countries or requires transfer mechanism (SCCs, BCRs, adequacy decision) |
-
----
-
-## Enforcement & Penalties
-
-| Aspect | CCPA/CPRA | GDPR |
-|---|---|---|
-| **Enforcement body** | California Privacy Protection Agency (CPPA) + California AG | Data Protection Authorities (DPAs) in each EU/EEA Member State |
-| **Civil penalties** | $2,500 per unintentional / $7,500 per intentional violation | Up to €10M or 2% (lower tier) / €20M or 4% (higher tier) of global annual turnover |
-| **Private right of action** | Yes — but limited to data breaches: $100–$750 per consumer per incident | Limited; EU Member States vary; class actions being developed |
-| **Criminal penalties** | No direct CCPA criminal liability | Some Member States have criminal provisions |
-| **Cure period** | 30-day cure notice period (for AG actions; CPPA administrative actions may differ) | No formal cure period |
-
----
-
-## Practical Dual-Compliance Guidance
-
-For organisations subject to both frameworks, the GDPR is generally the more demanding law. A GDPR-compliant programme will cover most CCPA/CPRA obligations with targeted additions:
-
-**What GDPR already covers:**
-- Privacy notices (at collection and policy)
-- Consumer/data subject rights processes (access, delete, correct, portability)
-- Processor agreements
-- Data minimization and purpose limitation
-- Retention schedules
-- Security measures
-
-**CCPA/CPRA-specific additions needed:**
-1. Add **"Do Not Sell or Share My Personal Information"** link and opt-out workflow
-2. Honor **Global Privacy Control (GPC)** signals
-3. Add **"Limit the Use of My Sensitive Personal Information"** link and 15-day response workflow
-4. Review vendor classification: are all "processors" actually **service providers** under CCPA (contracts may need updating)?
-5. Implement **minors' opt-in** consent for sale/sharing (under 16)
-6. Add **financial incentive / loyalty programme** disclosures if applicable
-7. Confirm business threshold compliance annually — revenues and data volume thresholds
-8. Prepare for **CPPA rulemaking** on automated decision-making and cybersecurity audits
+# CCPA/CPRA vs. GDPR — Side-by-Side Comparison
+
+For organisations subject to both laws (e.g., a US company with EU customers, or an EU company with California customers), understanding the differences and overlaps is essential to building an efficient dual-compliance programme.
+
+---
+
+## Scope & Applicability
+
+| Dimension | CCPA/CPRA | GDPR |
+|---|---|---|
+| **Jurisdictional trigger** | Doing business in California | Processing EU/EEA/UK residents' personal data |
+| **Who is covered** | For-profit businesses meeting threshold criteria | Any controller or processor, regardless of size or location |
+| **Size/revenue thresholds** | Yes — $25M revenue OR 100K+ consumers OR 50%+ revenue from PI sale/sharing | No — applies to any organisation processing EU personal data |
+| **Non-profits** | Generally exempt | Covered |
+| **Government entities** | Exempt | Covered (public authorities have specific rules) |
+| **B2B data** | Generally excluded (employee data limited exemption extended by CPRA) | Covered |
+
+---
+
+## Key Definitions
+
+| Concept | CCPA/CPRA | GDPR |
+|---|---|---|
+| **Personal data/PI** | Broadly defined; includes household data | Broadly defined; personal to identified/identifiable individual only |
+| **Special/sensitive categories** | CPRA SPI: SSN, precise geolocation, biometric, health, racial/ethnic, religious, union, sexual orientation, genetic, credentials, comms content | Special categories: racial/ethnic, political opinion, religious, union, genetic, biometric, health, sex life, sexual orientation |
+| **Controller equivalent** | "Business" | "Controller" |
+| **Processor equivalent** | "Service Provider" + "Contractor" (CPRA) | "Processor" |
+| **Third party** | Entity that receives PI that is not a service provider/contractor | Not separately defined in same way |
+| **Sale of data** | Broad: monetary or other valuable consideration | No equivalent concept; disclosure to third party = separate processing activity |
+| **Sharing (cross-context behavioral advertising)** | CPRA-specific concept | No direct equivalent; covered under legitimate interests or consent for tracking |
+
+---
+
+## Lawful Basis
+
+| Aspect | CCPA/CPRA | GDPR |
+|---|---|---|
+| **Basis for processing** | No lawful basis requirement — businesses can collect PI without consent (for most purposes) | Requires one of six lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests) |
+| **Consent for sensitive data** | Right to limit SPI use (opt-out model for most businesses) | Explicit consent required for special category data (with narrow exceptions) |
+| **Opt-in vs. opt-out** | Primarily opt-out model (consumers must affirmatively request opt-out) | Primarily opt-in model (consent must be freely given, specific, informed, unambiguous) |
+| **Minors (under 16)** | Opt-in required for sale/sharing of PI of consumers 13–16; parental consent under 13 | GDPR age of consent varies by Member State (13–16); parental consent for under-16 processing based on consent |
+
+---
+
+## Consumer / Data Subject Rights
+
+| Right | CCPA/CPRA | GDPR |
+|---|---|---|
+| **Right to access** | Yes — specific pieces + categories (12-month scope pre-CPRA, no limit post-Jan 2022) | Yes — all personal data, no 12-month limitation |
+| **Right to delete** | Yes — with numerous exceptions | Yes (right to erasure) — with exceptions |
+| **Right to correct** | Yes (CPRA addition) | Yes (right to rectification) |
+| **Right to portability** | Yes — portable format in access request | Yes — explicitly structured, commonly used, machine-readable format |
+| **Right to opt-out of sale** | Yes — "Do Not Sell or Share My Personal Information" | No direct equivalent; may be covered by withdrawal of consent or objection to legitimate interests |
+| **Right to restrict processing** | Limited — SPI limitation right (CPRA) | Yes — broader right to restrict processing |
+| **Right to object** | Limited — opt-out of sale/sharing | Yes — right to object to processing based on legitimate interests or direct marketing |
+| **Automated decision-making** | Pending CPPA rulemaking; opt-out right likely | Yes (Art. 22) — right not to be subject to solely automated decisions with significant effects |
+| **Non-discrimination** | Yes (§1798.125) | No direct equivalent |
+| **Response deadline** | 45 days + 45-day extension; SPI limit: 15 business days | 1 month + 2-month extension |
+
+---
+
+## Privacy Notices
+
+| Requirement | CCPA/CPRA | GDPR |
+|---|---|---|
+| **At-collection notice** | Yes — categories, purposes, whether PI is sold/shared, link to privacy policy | Yes — Art. 13/14 privacy notice at collection |
+| **Privacy policy** | Yes — comprehensive; updated annually | Yes — privacy notice must be accessible |
+| **Retention periods** | Yes (CPRA addition) | Yes (must be specified or criteria stated) |
+| **Lawful basis disclosure** | No — not applicable | Yes — must identify lawful basis for each processing purpose |
+| **GPC signal** | Must honor as valid opt-out | No equivalent; but ePrivacy Directive may cover browser signals |
+
+---
+
+## Vendor / Third-Party Management
+
+| Aspect | CCPA/CPRA | GDPR |
+|---|---|---|
+| **Processor agreements** | Required with service providers and contractors | Required Data Processing Agreements (Art. 28) |
+| **Contract requirements** | Purpose limitation, prohibition on resale, deletion, audit rights | Detailed Art. 28 requirements: processing only on instructions, security, subprocessor rules, return/deletion |
+| **Sub-processor** | Contractor / downstream service provider must also comply | Subprocessors require DPA + controller notification/approval |
+| **International transfers** | No transfer restriction mechanism (CCPA does not restrict cross-border transfers) | Restricted to adequate countries or requires transfer mechanism (SCCs, BCRs, adequacy decision) |
+
+---
+
+## Enforcement & Penalties
+
+| Aspect | CCPA/CPRA | GDPR |
+|---|---|---|
+| **Enforcement body** | California Privacy Protection Agency (CPPA) + California AG | Data Protection Authorities (DPAs) in each EU/EEA Member State |
+| **Civil penalties** | $2,500 per unintentional / $7,500 per intentional violation | Up to €10M or 2% (lower tier) / €20M or 4% (higher tier) of global annual turnover |
+| **Private right of action** | Yes — but limited to data breaches: $100–$750 per consumer per incident | Limited; EU Member States vary; class actions being developed |
+| **Criminal penalties** | No direct CCPA criminal liability | Some Member States have criminal provisions |
+| **Cure period** | 30-day cure notice period (for AG actions; CPPA administrative actions may differ) | No formal cure period |
+
+---
+
+## Practical Dual-Compliance Guidance
+
+For organisations subject to both frameworks, the GDPR is generally the more demanding law. A GDPR-compliant programme will cover most CCPA/CPRA obligations with targeted additions:
+
+**What GDPR already covers:**
+- Privacy notices (at collection and policy)
+- Consumer/data subject rights processes (access, delete, correct, portability)
+- Processor agreements
+- Data minimization and purpose limitation
+- Retention schedules
+- Security measures
+
+**CCPA/CPRA-specific additions needed:**
+1. Add **"Do Not Sell or Share My Personal Information"** link and opt-out workflow
+2. Honor **Global Privacy Control (GPC)** signals
+3. Add **"Limit the Use of My Sensitive Personal Information"** link and 15-day response workflow
+4. Review vendor classification: are all "processors" actually **service providers** under CCPA (contracts may need updating)?
+5. Implement **minors' opt-in** consent for sale/sharing (under 16)
+6. Add **financial incentive / loyalty programme** disclosures if applicable
+7. Confirm business threshold compliance annually — revenues and data volume thresholds
+8. Prepare for **CPPA rulemaking** on automated decision-making and cybersecurity audits

package/src/bmad-plus/packs/pack-shield/references/ccpa/consumer-rights-workflows.md

@@ -1,177 +1,177 @@
-# CCPA/CPRA Consumer Rights — Fulfillment Workflows
-
-## General Request Handling Principles
-
-**Intake channels (§1798.130):** Businesses must provide at least two methods for submitting requests, including (where applicable) a toll-free phone number and a web form or email. Online-only businesses may provide an email address as one method.
-
-**Identity verification:** Must verify consumer identity before disclosing or deleting PI. Verification requirements scale with sensitivity:
-- For non-sensitive requests: match 2 data points the business already holds
-- For sensitive PI / financial data: match 3 data points + signed declaration under penalty of perjury
-- For requests submitted through an authorized agent: require written permission + verification of agent identity
-
-**Response timelines:** 45 calendar days from receipt (extendable once by another 45 days with notice). For SPI limitation requests: 15 business days.
-
-**Free of charge:** Requests must be fulfilled free of charge, twice per 12-month period. Businesses may charge a reasonable fee for additional requests within 12 months if manifestly unfounded or excessive.
-
----
-
-## Right to Know (§1798.110 / §1798.115)
-
-**What must be disclosed:**
-- Specific pieces of PI collected about the consumer
-- Categories of PI collected
-- Categories of sources from which PI was collected
-- Business or commercial purpose for collecting, selling, or sharing PI
-- Categories of third parties to whom PI was disclosed
-- Categories of PI sold or shared and the categories of third parties to whom it was sold/shared
-
-**Scope:** Covers PI collected in the 12 months prior to request (and ongoing from January 1, 2022 under CPRA, with no 12-month limit for data collected after that date).
-
-**Exceptions where disclosure can be refused:**
-- Would require disclosing third-party trade secrets
-- Would conflict with federal/state law
-- PI collected for single one-time transaction and not retained
-- PI solely for internal operations consistent with context of collection
-- Solely used to complete the transaction for which collected
-
-**Workflow:**
-1. Receive and log request with timestamp
-2. Verify consumer identity (2-point match for standard requests)
-3. Search PI systems using identifying data
-4. Compile responsive PI across all systems (CRM, analytics, ad tech, etc.)
-5. Apply exceptions — remove third-party trade secrets, conflicting legal holds
-6. Deliver response in portable, readily usable format within 45 days
-7. Provide notice if extension is needed (within original 45-day window)
-
----
-
-## Right to Delete (§1798.105)
-
-**Business must:**
-- Delete the consumer's PI from its records
-- Direct service providers and contractors to delete the PI
-
-**Exceptions (business may retain PI if necessary to):**
-1. Complete a transaction or perform a contract
-2. Detect security incidents; protect against malicious, deceptive, fraudulent, or illegal activity
-3. Fix errors that impair intended functionality
-4. Exercise free speech or ensure another consumer's right to free speech
-5. Comply with a legal obligation (CCPA §1798.145(a))
-6. Use PI solely for internal purposes in a manner compatible with the context of collection (limited CPRA exception)
-7. Research, journalism, or statistical purposes in the public interest
-
-**Workflow:**
-1. Receive and log deletion request
-2. Verify consumer identity
-3. Check if any exceptions apply; document reasoning if invoking an exception
-4. If proceeding with deletion: identify all PI records, propagate deletion to service providers and contractors
-5. Confirm deletion to consumer (or explain exception invoked) within 45 days
-6. Retain deletion request records (for proof of compliance) — note: retaining the request itself is not a contradiction
-
----
-
-## Right to Correct (§1798.106) — CPRA Addition
-
-**What the business must do:**
-- Take commercially reasonable steps to correct inaccurate PI
-- Instruct service providers and contractors to correct the PI
-- Consumer must provide documentation if business contests the claimed inaccuracy
-
-**Business may decline if:**
-- Correction would require revealing another individual's PI
-- Business disagrees the PI is inaccurate and documents its decision
-
-**Workflow:**
-1. Receive correction request with claimed correction details
-2. Verify consumer identity
-3. Evaluate accuracy of the claimed correction (may request supporting documentation)
-4. If agreeing to correct: update all relevant systems; instruct service providers and contractors
-5. Notify consumer of outcome within 45 days
-
----
-
-## Right to Opt-Out of Sale / Sharing (§1798.120)
-
-**Scope:** Applies to:
-- **Sale**: disclosure of PI to a third party for monetary or other valuable consideration
-- **Sharing** (CPRA): disclosure of PI to a third party for cross-context behavioral advertising
-
-**Mechanics:**
-- "Do Not Sell or Share My Personal Information" link must be prominently placed on homepage and in privacy policy
-- Must honor the **Global Privacy Control (GPC)** signal as a valid opt-out — the CPPA has confirmed GPC compliance is required
-- Once opted out, the business must wait **12 months** before asking the consumer to re-consent
-
-**Impact on advertising:**
-- Opt-out means the business cannot pass PI (including cookie IDs, device fingerprints) to ad tech partners, ad exchanges, or DMPs for targeting
-- Analytics via first-party tools that do not involve PI disclosure to third parties are typically not affected
-
-**Workflow:**
-1. Consumer submits opt-out via link, form, or GPC signal
-2. No identity verification required for opt-out (only reasonable verification to confirm they are the consumer)
-3. Update consent/preference management platform within 15 business days
-4. Propagate opt-out to service providers and contractors engaged in sale/sharing
-5. Do not contact consumer for 12 months to ask them to reconsider
-
----
-
-## Right to Limit Use of Sensitive Personal Information (§1798.121) — CPRA Addition
-
-**Sensitive Personal Information (SPI) categories:**
-- Social Security numbers, driver's license, passport, other government IDs
-- Financial account credentials (login + security code)
-- Precise geolocation (within 1/4 mile)
-- Racial/ethnic origin, religious/philosophical beliefs, union membership
-- Contents of consumer mail, email, or text messages (unless business is the intended recipient)
-- Genetic data
-- Biometric data for uniquely identifying a person
-- Health/medical information
-- Sexual orientation or sex life
-
-**Permitted uses without limitation right:**
-Business may use SPI without offering limitation if the purpose is:
-- Performing services or providing goods reasonably expected by a consumer
-- Safety, security, and integrity of services
-- Short-term, transient use (e.g., contextual ad based on current session)
-- Services on behalf of the business (service provider context)
-- Verifying or maintaining quality of services
-- Activities for which SPI was provided
-
-**Workflow:**
-1. Provide "Limit the Use of My Sensitive Personal Information" link on homepage (alongside or combined with "Do Not Sell or Share" link)
-2. Consumer exercises right — no identity verification required beyond confirming consumer identity
-3. Process within **15 business days**
-4. Restrict use of SPI to only the permitted purposes listed above
-5. Propagate limitation to service providers and contractors
-
----
-
-## Right to Non-Discrimination (§1798.125)
-
-Businesses **cannot**, because a consumer exercised a CCPA/CPRA right:
-- Deny goods or services
-- Charge a different price (except where directly related to value of data)
-- Provide a different level or quality of goods/services
-- Suggest any of the above will occur
-
-**Exception:** Businesses may offer financial incentives (loyalty programs, discounts) in exchange for PI, provided:
-- The financial incentive is reasonably related to the value of the consumer's PI
-- Consumer provides opt-in consent with a clear description of material terms
-- Consumer can withdraw at any time
-
----
-
-## Authorized Agent Requests
-
-Consumers may designate an authorized agent to submit requests on their behalf. Business must:
-- Require written permission from the consumer (signed authorization)
-- Verify the agent's identity
-- May require direct verification with the consumer as well (except for opt-out requests where agent has power of attorney)
-
----
-
-## Record-Keeping
-
-**CPRA requires businesses handling PI of 10M+ consumers/households** to maintain records of:
-- Consumer requests and responses for 24 months
-- Disclosures for 24 months
-- Training records for CCPA/CPRA compliance
+# CCPA/CPRA Consumer Rights — Fulfillment Workflows
+
+## General Request Handling Principles
+
+**Intake channels (§1798.130):** Businesses must provide at least two methods for submitting requests, including (where applicable) a toll-free phone number and a web form or email. Online-only businesses may provide an email address as one method.
+
+**Identity verification:** Must verify consumer identity before disclosing or deleting PI. Verification requirements scale with sensitivity:
+- For non-sensitive requests: match 2 data points the business already holds
+- For sensitive PI / financial data: match 3 data points + signed declaration under penalty of perjury
+- For requests submitted through an authorized agent: require written permission + verification of agent identity
+
+**Response timelines:** 45 calendar days from receipt (extendable once by another 45 days with notice). For SPI limitation requests: 15 business days.
+
+**Free of charge:** Requests must be fulfilled free of charge, twice per 12-month period. Businesses may charge a reasonable fee for additional requests within 12 months if manifestly unfounded or excessive.
+
+---
+
+## Right to Know (§1798.110 / §1798.115)
+
+**What must be disclosed:**
+- Specific pieces of PI collected about the consumer
+- Categories of PI collected
+- Categories of sources from which PI was collected
+- Business or commercial purpose for collecting, selling, or sharing PI
+- Categories of third parties to whom PI was disclosed
+- Categories of PI sold or shared and the categories of third parties to whom it was sold/shared
+
+**Scope:** Covers PI collected in the 12 months prior to request (and ongoing from January 1, 2022 under CPRA, with no 12-month limit for data collected after that date).
+
+**Exceptions where disclosure can be refused:**
+- Would require disclosing third-party trade secrets
+- Would conflict with federal/state law
+- PI collected for single one-time transaction and not retained
+- PI solely for internal operations consistent with context of collection
+- Solely used to complete the transaction for which collected
+
+**Workflow:**
+1. Receive and log request with timestamp
+2. Verify consumer identity (2-point match for standard requests)
+3. Search PI systems using identifying data
+4. Compile responsive PI across all systems (CRM, analytics, ad tech, etc.)
+5. Apply exceptions — remove third-party trade secrets, conflicting legal holds
+6. Deliver response in portable, readily usable format within 45 days
+7. Provide notice if extension is needed (within original 45-day window)
+
+---
+
+## Right to Delete (§1798.105)
+
+**Business must:**
+- Delete the consumer's PI from its records
+- Direct service providers and contractors to delete the PI
+
+**Exceptions (business may retain PI if necessary to):**
+1. Complete a transaction or perform a contract
+2. Detect security incidents; protect against malicious, deceptive, fraudulent, or illegal activity
+3. Fix errors that impair intended functionality
+4. Exercise free speech or ensure another consumer's right to free speech
+5. Comply with a legal obligation (CCPA §1798.145(a))
+6. Use PI solely for internal purposes in a manner compatible with the context of collection (limited CPRA exception)
+7. Research, journalism, or statistical purposes in the public interest
+
+**Workflow:**
+1. Receive and log deletion request
+2. Verify consumer identity
+3. Check if any exceptions apply; document reasoning if invoking an exception
+4. If proceeding with deletion: identify all PI records, propagate deletion to service providers and contractors
+5. Confirm deletion to consumer (or explain exception invoked) within 45 days
+6. Retain deletion request records (for proof of compliance) — note: retaining the request itself is not a contradiction
+
+---
+
+## Right to Correct (§1798.106) — CPRA Addition
+
+**What the business must do:**
+- Take commercially reasonable steps to correct inaccurate PI
+- Instruct service providers and contractors to correct the PI
+- Consumer must provide documentation if business contests the claimed inaccuracy
+
+**Business may decline if:**
+- Correction would require revealing another individual's PI
+- Business disagrees the PI is inaccurate and documents its decision
+
+**Workflow:**
+1. Receive correction request with claimed correction details
+2. Verify consumer identity
+3. Evaluate accuracy of the claimed correction (may request supporting documentation)
+4. If agreeing to correct: update all relevant systems; instruct service providers and contractors
+5. Notify consumer of outcome within 45 days
+
+---
+
+## Right to Opt-Out of Sale / Sharing (§1798.120)
+
+**Scope:** Applies to:
+- **Sale**: disclosure of PI to a third party for monetary or other valuable consideration
+- **Sharing** (CPRA): disclosure of PI to a third party for cross-context behavioral advertising
+
+**Mechanics:**
+- "Do Not Sell or Share My Personal Information" link must be prominently placed on homepage and in privacy policy
+- Must honor the **Global Privacy Control (GPC)** signal as a valid opt-out — the CPPA has confirmed GPC compliance is required
+- Once opted out, the business must wait **12 months** before asking the consumer to re-consent
+
+**Impact on advertising:**
+- Opt-out means the business cannot pass PI (including cookie IDs, device fingerprints) to ad tech partners, ad exchanges, or DMPs for targeting
+- Analytics via first-party tools that do not involve PI disclosure to third parties are typically not affected
+
+**Workflow:**
+1. Consumer submits opt-out via link, form, or GPC signal
+2. No identity verification required for opt-out (only reasonable verification to confirm they are the consumer)
+3. Update consent/preference management platform within 15 business days
+4. Propagate opt-out to service providers and contractors engaged in sale/sharing
+5. Do not contact consumer for 12 months to ask them to reconsider
+
+---
+
+## Right to Limit Use of Sensitive Personal Information (§1798.121) — CPRA Addition
+
+**Sensitive Personal Information (SPI) categories:**
+- Social Security numbers, driver's license, passport, other government IDs
+- Financial account credentials (login + security code)
+- Precise geolocation (within 1/4 mile)
+- Racial/ethnic origin, religious/philosophical beliefs, union membership
+- Contents of consumer mail, email, or text messages (unless business is the intended recipient)
+- Genetic data
+- Biometric data for uniquely identifying a person
+- Health/medical information
+- Sexual orientation or sex life
+
+**Permitted uses without limitation right:**
+Business may use SPI without offering limitation if the purpose is:
+- Performing services or providing goods reasonably expected by a consumer
+- Safety, security, and integrity of services
+- Short-term, transient use (e.g., contextual ad based on current session)
+- Services on behalf of the business (service provider context)
+- Verifying or maintaining quality of services
+- Activities for which SPI was provided
+
+**Workflow:**
+1. Provide "Limit the Use of My Sensitive Personal Information" link on homepage (alongside or combined with "Do Not Sell or Share" link)
+2. Consumer exercises right — no identity verification required beyond confirming consumer identity
+3. Process within **15 business days**
+4. Restrict use of SPI to only the permitted purposes listed above
+5. Propagate limitation to service providers and contractors
+
+---
+
+## Right to Non-Discrimination (§1798.125)
+
+Businesses **cannot**, because a consumer exercised a CCPA/CPRA right:
+- Deny goods or services
+- Charge a different price (except where directly related to value of data)
+- Provide a different level or quality of goods/services
+- Suggest any of the above will occur
+
+**Exception:** Businesses may offer financial incentives (loyalty programs, discounts) in exchange for PI, provided:
+- The financial incentive is reasonably related to the value of the consumer's PI
+- Consumer provides opt-in consent with a clear description of material terms
+- Consumer can withdraw at any time
+
+---
+
+## Authorized Agent Requests
+
+Consumers may designate an authorized agent to submit requests on their behalf. Business must:
+- Require written permission from the consumer (signed authorization)
+- Verify the agent's identity
+- May require direct verification with the consumer as well (except for opt-out requests where agent has power of attorney)
+
+---
+
+## Record-Keeping
+
+**CPRA requires businesses handling PI of 10M+ consumers/households** to maintain records of:
+- Consumer requests and responses for 24 months
+- Disclosures for 24 months
+- Training records for CCPA/CPRA compliance