California CCPA/CPRA evidence

Enable and scope CaliforniaCopy Anchor Link

Enable California CCPA/CPRA in Settings in the full edition. CPRA amends the CCPA; Sparta treats them as one framework.

Record the systems, processing activities and organizational roles in scope. Have the responsible privacy reviewer assess applicability and document any exclusions. Enabling the framework does not determine whether a legal obligation applies.

Maintain private operating recordsCopy Anchor Link

Open Documents → Open private California workspace. Use the six registers for:

• Scope and roles.
• Processing inventory.
• Recipient contracts.
• Consumer requests.
• Assessments and audits.
• Retention and deletion.

Assign owners, record decisions and link supporting evidence. Use opaque case references; keep identity documents, correspondence and raw personal information in the approved restricted case system.

Administrators manage all records. Owners can access assigned records, while scope decisions require an administrator. External auditors cannot access or export the private registers.

Review evidence and exportsCopy Anchor Link

Use the checklist to review mapped controls and assign gaps. Review automated checks alongside redacted operating samples. A saved request record does not prove that a connected service enforced an opt-out or deleted information.

Generate a California framework report from Reports. Framework reports contain reviewed control evidence, not private register contents. Administrators can export the private California register separately; handle that export as restricted information.

Sparta records readiness, decisions and evidence. It does not execute consumer requests, submit regulatory attestations or certify legal compliance.