Respond to a request to know what personal information a business holds
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Log the date of the request, whether the business has verified the requester, and which of the five disclosure items the draft response covers: categories or specific pieces, sources, purposes, categories of third parties, and categories sold or disclosed.
- What the lawyer must review
- Both the Attorney General's CCPA page and the California Privacy Protection Agency's FAQ describe a right to know. The consumer can request the categories or specific pieces collected, the categories of sources, the purposes, the categories of third parties to whom the business discloses the information, and the categories sold or shared. Both pages say a request to know can be made up to twice a year, free of charge. The Attorney General's page says the business must verify that the requester is the consumer and may use verification information only for that purpose. The right belongs to a California resident. A business that is not a covered business under the Agency's thresholds does not have this duty.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Potential support includes preparing preliminary structure or wording. Confirm the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.