--- title: "CCPA Checklist: Request Processing - TrueVault" --- - [CCPA](https://safe.truevault.com/learn/ccpa/what-is-the-ccpa) - [GDPR Compliance](https://safe.truevault.com/gdpr-guide) - [HIPAA](https://safe.truevault.com/learn/hipaa) - [HIPAA Compliance](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [Personally Identifiable Information](https://safe.truevault.com/blog/what-is-pii) - [PHI](https://safe.truevault.com/protected-health-information) - [Resources](https://safe.truevault.com/learn/?hsLang=en) - Login [TrueVault Safe Log in to TrueVault Safe](https://console.truevault.com) [TrueVault Polaris Log in to TrueVault Polaris](https://polaris.truevault.com) - [Resources](https://safe.truevault.com/learn/?hsLang=en) - Login - Login - [TrueVault Safe Log in to TrueVault Safe](https://console.truevault.com) - [TrueVault Polaris Log in to TrueVault Polaris](https://polaris.truevault.com) [CCPA RESOURCES CENTER](https://www.truevault.com/learn/ccpa?hsLang=en) › CCPA COMPLIANCE CHECKLIST # CCPA Compliance: Request Processing Checklist Table of Contents keyboard\_arrow\_right [Overview](https://www.truevault.com/ccpa-checklist?hsLang=en) [Data Mapping Checklist](https://www.truevault.com/ccpa-checklist/data-mapping?hsLang=en) [Vendor Classification Checklist](https://www.truevault.com/ccpa-checklist/vendor-classification?hsLang=en) [Privacy Policy and Notices Checklist](https://www.truevault.com/ccpa-checklist/privacy-policy-and-notices?hsLang=en) [Request Processing Checklist](https://www.truevault.com/ccpa-checklist/request-processing?hsLang=en) [Staying Compliant Checklist](https://www.truevault.com/ccpa-checklist/staying-compliant?hsLang=en) - [Overview](https://www.truevault.com/ccpa-checklist?hsLang=en) - [The Five Major Steps to CCPA Compliance](https://www.truevault.com/ccpa-checklist?hsLang=en#five-steps-to-ccpa-compliance) - [Data Mapping Checklist](https://www.truevault.com/ccpa-checklist/data-mapping?hsLang=en) - [Incoming Personal Information](https://www.truevault.com/ccpa-checklist/data-mapping?hsLang=en#incoming-personal-information) - [Outgoing Personal Information](https://www.truevault.com/ccpa-checklist/data-mapping?hsLang=en#outgoing-personal-information) - [Vendor Classification Checklist](https://www.truevault.com/ccpa-checklist/vendor-classification?hsLang=en) - [Steps for Classifying Individual Vendors](https://www.truevault.com/ccpa-checklist/vendor-classification?hsLang=en#classifying-individual-vendors) - [Privacy Policy and Notices Checklist](https://www.truevault.com/ccpa-checklist/privacy-policy-and-notices?hsLang=en) - [Request Processing Checklist](https://www.truevault.com/ccpa-checklist/request-processing?hsLang=en) - [Right to Know Requests](https://www.truevault.com/ccpa-checklist/request-processing?hsLang=en#right-to-know-requests) - [Right to Delete Requests](https://www.truevault.com/ccpa-checklist/request-processing?hsLang=en#right-to-delete-requests) - [Right to Opt Out Requests](https://www.truevault.com/ccpa-checklist/request-processing?hsLang=en#right-to-opt-out-requests) - [Staying Compliant Checklist](https://www.truevault.com/ccpa-checklist/staying-compliant?hsLang=en) - [Quarterly CCPA Maintenance](https://www.truevault.com/ccpa-checklist/staying-compliant?hsLang=en#quarterly-ccpa-maintenance) - [Annual CCPA Maintenance](https://www.truevault.com/ccpa-checklist/staying-compliant?hsLang=en#annual-ccpa-maintenance) ## Request Processing Beyond making the necessary disclosures via the privacy policy, businesses must respond to consumers’ privacy requests as they come in. Not only must they be handled in a timely manner, each type of privacy request has [its own set of rules and exceptions](https://safe.truevault.com/ccpa-guide/getting-ccpa-compliant#responding-to-ccpa-privacy-requests). Preparing for these ahead of time will help you create quick, uniform responses that comply with all CCPA requirements. ### Requests to Know - Establish verification procedures Consumer requests to know [must be verified](https://safe.truevault.com/learn/ccpa/how-to-verify-a-ccpa-consumer-request#requests-to-know) before the business can respond, but the verification requirements vary depending on the specific type of request. - Two or more methods Businesses must offer two more methods for submitting a request to know, including a toll-free number. At least one of these methods should relate to the business’s normal way of interacting with consumers. - Identify which categories of personal information are associated with each consumer group Refer to your business’s data map to determine what information must be provided and where it is maintained. - Identify sensitive personal information that cannot be provided For security reasons, [some specific pieces of information should not be disclosed](https://safe.truevault.com/ccpa-guide/getting-ccpa-compliant#request-to-know). In these cases, only disclose that your business has collected that specific type of information. - Draft form letter A form letter will help ensure that each response has the required information, as well as reduce the time needed to create each response. - Response deadline: 45 days - Practice responses Responding to a few hypothetical consumer requests will help make sure there are no gaps in the process and staff knows where to find all the necessary information. ### Requests to Delete - Establish verification procedures Consumer requests to delete [must be verified](https://safe.truevault.com/learn/ccpa/how-to-verify-a-ccpa-consumer-request#requests-to-delete) before the business can respond, but the verification requirements vary depending on the type of information to be deleted. - Two or more methods Businesses must offer two more methods for submitting a request to delete. At least one of these methods should relate to the business’s normal way of interacting with consumers. - Identify which categories of personal information are associated with each consumer group Refer to your business’s data map to determine what information must be deleted and where it is maintained. - Identify personal information that is exempted from deletion requests To prevent unnecessary deletions, determine in advance which personal information [falls under an exemption](https://safe.truevault.com/ccpa-guide/what-is-the-ccpa#right-to-delete). - Deidentifying or aggregating options Personal information that is deidentified or in the aggregate need not be deleted. Explore whether any information can be retained in this way. - Draft form letter - Send deletion request to service providers Service providers must also respond to deletion requests. Establish a process for sending notifications to all appropriate service providers. - Response deadline: 45 days - Practice responses ### Requests to Opt Out - Requests from authorized agents Requests to opt out need not be verified. Consumers can send requests through an authorized agent, however, so businesses should still have a procedure for verifying this authorization. - Two or more methods Businesses must offer two or more methods for submitting a request to opt out. At least one of these methods should relate to the way the business normally interacts with consumers. - Identify any sale or sharing of personal information associated with each consumer group Refer to your business’s data map to determine what information is being sold or shared. - Establish procedures for stopping the sale or sharing of personal information Some companies such as Facebook and Google have options for the reduced processing of consumers’ personal information so it is no longer considered a sale. These options can be applied to particular consumers. - Draft form letter - Send notification to third parties Businesses must notify all third parties to whom they sell or share consumers’ personal information. - Response deadline: 15 days There is no extension for responding to an opt-out request. - Practice responses ### Requests to Correct - Establish verification procedures Consumer requests to correct [should be verified](https://safe.truevault.com/learn/ccpa/how-to-verify-a-ccpa-consumer-request#requests-to-delete) before the business responds, though it's not required. - Two or more methods Businesses must offer two more methods for submitting a request to delete. At least one of these methods should relate to the business’s normal way of interacting with consumers. - Draft form letter - Inform the consumer of any personal information that was not altered and why If, considering the totality of the circumstances, the personal information at issue is not inaccurate, the business can deny the request. If it does so, the business must explain its decision to the consumer. - Send correction request to service providers Service providers must also respond to correction requests. Establish a process for sending notifications to all appropriate service providers. - Response deadline: 45 days - Confirm receipt of request: 10 days - Extension: 45 days - Practice responses ### Requests to Limit - No Verification Required Verification cannot be required for a request to limit, though a business may deny a request if it has a good-faith, reasonable, and documented belief that the request is fraudulent. If it denies the request on this basis, the business must provide an explanation to the consumer. - Two or more methods Businesses must offer two more methods for submitting a request to delete. At least one of these methods should relate to the business’s normal way of interacting with consumers. - Draft form letter - Send request to service providers Service providers must also respond to these requests. Establish a process for sending notifications to all appropriate service providers. - Response deadline: 15 days There is no extension for responding to a request to limit. - Practice responses ### CCPA Privacy Request Templates Responding quickly and properly to a privacy request requires an accurate data map and a thorough understanding of the CCPA. TrueVault makes it easier to handle these requests. Our templates automatically reflect the information in your data map in order to help you determine the right process for responding to CCPA requests. Contact our team today to learn more about TrueVault. [![Schedule Call](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/4693513/949d85da-b649-4822-b380-0922b22c3b60.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/4693513/949d85da-b649-4822-b380-0922b22c3b60) **Disclaimer:** This content is provided for general informational purposes only and does not constitute legal or other professional advice. Without limiting the foregoing, the content may not reflect recent developments in the law, may not be complete, and may not be accurate or relevant in an applicable jurisdiction. This content is not a substitute for obtaining legal advice from a qualified licensed attorney in the applicable jurisdiction. The content is general in nature and may not pertain to specific circumstances, so it should not be used to act or refrain from acting based on it without first obtaining advice from professional counsel qualified in the applicable subject matter and jurisdictions. ### Company - [Blog](https://safe.truevault.com/blog) - [Contact Us](https://safe.truevault.com/contact-us-2019) - [Careers](https://truevault.workable.com) - [HIPAA Compliance Checklist](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [PDF: Developers Guide to HIPAA compliance](https://my.leadpages.net/leadbox/14472b173f72a2%3A131fd12f8b46dc/5760820306771968/) ### Developers - [Patterns](https://safe.truevault.com/patterns) - [Documentation](https://docs.truevault.com/) - [Quick Start Guide](https://safe.truevault.com/quick-start-guide) - [Secure Infrastructure](https://safe.truevault.com/secure-infrastructure) - [API Overview](https://safe.truevault.com/api-overview) ### Latest Posts ### Contact Us 201 Mission Street, 12th Floor San Francisco, CA 94105 Email: [hello@truevault.com](mailto:hello@truevault.com) 2024 © All Rights Reserved.  [Privacy Policy](https://privacy.truevault.com/privacy-policy)  |  [Terms of Use](https://www.truevault.com/legal/truevault-terms-of-use?hsLang=en)  |  [Supplemental Terms](https://www.truevault.com/legal/truevault-supplemental-terms-of-use?hsLang=en) | [California Privacy Notice](https://privacy.truevault.com/privacy-policy#california-privacy-notice)