Policy · Privacy, Data Protection & Cyber
CCPA privacy policy
Privacy policy for a business that the California Consumer Privacy Act may cover. It sets out categories, retention, sale or sharing, and the rights in the sections that were read. Sections that were not opened are left for the lawyer to write.
- Kind
- Policy. A policy or procedure for a firm or client.
- Where it applies
- United States
- AI use
- Yellow You and the tool draft together, with you directing. You check every statement you rely on.
- Law stated as at
- 22 October 2026
- Status
- Maintained. Checked on 22 October 2026 against the 5 authorities it cites, for United States.
- Version
- 1
- Source
- Written for this library
When to use it
Use when a for-profit business doing business in California needs the policy section 1798.130 describes. Do not publish it until the lawyer has confirmed the business test, filled every category from real practices, and written the descriptions of sections 1798.106, 1798.115 and 1798.125.
Used for these tasks
- Draft or review a privacy policy and collection notice
- Audit a client privacy policy for AI disclosures and chatbot labelling
Each task page says how far AI may help with the task and what the lawyer must review.
How AI may be used
AI may sort the client's data map into the category table and flag empty rows. The lawyer confirms the business is covered, writes the unopened-section descriptions, and checks every category against the last 12 months before publication.
AI may
- Place the client's data-map entries into the category, source and purpose table
- Flag a row with no retention period and no criteria
- Compare this draft with the prior policy and list categories that were added or dropped
AI must not
- Must not decide that the client is a business or state an adjusted revenue figure
- Must not draft the descriptions of sections 1798.106, 1798.115, 1798.120, 1798.125 or 1798.135
- Must not invent a 'Do Not Sell or Share' link label, or state that personal information is not sold if the data map does not say so
The lawyer checks
- The business test in section 1798.140(d) has been applied, including the revenue threshold as adjusted, with no substituted dollar figure
- Every category, purpose, sale or share statement and retention period matches the last 12 months of practice
- The passages for sections 1798.106, 1798.115 and 1798.125 are the lawyer's, written from those sections, and the policy is updated at least every 12 months
Method: how the Green, Yellow and Red levels are decided. This is guidance for planning, not legal advice.
Read the full text
The full text is available after you log in. It is free. When you log in you can:
- read the whole precedent, with its drafting notes beside it;
- copy it, or download it as a Word file or Markdown;
- add it to your firm’s knowledge base, so colleagues can find it;
- let the AI tools you connect read it from that knowledge base.
The summary, the law it rests on and the AI-use guidance above stay public. Privacy.
More in Privacy, Data Protection & Cyber
- Response to a request for access to personal information (APP 12), with refusal notice and correction options (APP 13)
- Cross-border disclosure of personal information under APP 8
- Data breach response plan (Notifiable Data Breaches scheme, with cyber reporting clocks)
- Response to a direct marketing opt-out or source request (APP 7.6 and 7.7)
- OAIC privacy complaint form
- Incident response plan outline
- Use or disclosure of personal information under APP 6
- Notification of an eligible data breach to affected individuals (Privacy Act s 26WL), with the public-notice option
- OAIC privacy complaint authorised representative form
- Notifiable data breach statement to the OAIC: completion guide for the online form
- Does the Privacy Act apply? Small business exemption assessment checklist and advice note (Privacy Act ss 6C to 6EA)
- Breach notice with a statute checklist
- Notice at collection
- Security and destruction of personal information under APP 11
- Employee records exemption: assessment checklist for a planned use of staff information (Privacy Act s 7B(3))
- APP privacy policy with AI and automated-decision disclosures (APP 1.4 and APP 1.7 to 1.9)
- Letter of demand for a serious invasion of privacy (statutory tort, Privacy Act Sch 2): take-down, undertakings and remedies
- Consumer request response
- Service-provider safeguards addendum
- Collection notice (APP 5) for forms, websites, apps and call scripts
- De-identification assessment record before a dataset is shared or released (Privacy Act s 6 definitions)
- Critical infrastructure cyber incident reporting clocks
- Serious invasion of privacy (statutory tort, Privacy Act Sch 2): claim assessment checklist
- California security breach notice
- Data protection clause for service providers, including AI vendors (no training, retention, offshore disclosure)
- AI and automated decisions clause for privacy policies and collection notices
- Privacy impact assessment checklist for an AI tool (supplement to the OAIC PIA tool)
All precedents for Privacy, Data Protection & Cyber · Tasks and AI use in this area