Remove the Technical Hurdles of CPRA
Skyflow addresses the key technical requirements of CPRA, so you can protect sensitive data, such as PII or sensitive personal information.
You can easily embed CPRA’s data privacy requirements into your systems:
Protect Sensitive Data from the Moment It’s Collected
Limit the Use of Sensitive Data
Gather, Correct, or Erase Sensitive Data Upon Request
TRUSTED BY
Get Your CPRA Readiness to a Golden State
Satisfy CPRA compliance by using a Data Privacy Vault to isolate, protect, and govern your customers’ sensitive data. CPRA adds regulations regarding data privacy to CCPA. Read on to learn about the differences between CPRA and CCPA.
With Skyflow, whether your customers reside in California, elsewhere in the US, or elsewhere, securing sensitive data and preventing its misuse just got simpler.
Solve CPRA and CCPA Together
CCPA already has provisions to penalize businesses between $2,500 and $7,500 per violation for data breaches. Additionally, CPRA violations are subject to a new civil penalty system and possible lawsuits from customers – up to $750 per consumer, per incident, or actual damages – whichever is greater.
The more personal information your business handles, the higher the potential fines. Skyflow can help you comply with CCPA more easily.
Privacy by Design
Skyflow Data Privacy Vault takes a zero trust approach to data privacy – never trust, always verify. Every data access request gets verified from the Data Privacy Vault so security and privacy don’t have to be a difficult afterthought.
Eliminate Breach Impact
Remove all the personal information from your infrastructure and replace it with format-preserving tokens. With personal information securely protected in your Skyflow vault, the rest of your infrastructure becomes less risky and more flexible, so you can move quickly and not break data privacy.
End Information Sprawl
Keep sensitive data isolated in a zero trust Data Privacy Vault instead of scattered across databases or systems. Managing one authoritative personal data source makes it quick and easy to respond to personal information requests.
Fine-grained Data Access Control
Quickly build and centrally manage the data access flows you need, within your organization and with third parties. Centrally control who sees what data, when, where, and how using any combination of policies, roles, and attributes.
Isolate, Protect, and Govern Sensitive Personal Data with a Data Privacy Vault
Centralized Sensitive Data Repository
Polymorphic Encryption
Advanced Data Governance Engine
Automated Audit Logs
Frequently Asked Questions about CPRA
Does CPRA Apply to My Organization?
The CPRA went into effect on January 1, 2023. It regulates any for-profit companies that do business in California, even those without a physical presence in the state. If your business collects personal information from California residents and meets one of the following threshold requirements, you’re subject to the CPRA:
- Annual gross revenues exceeding $25 million
- Annually sells/buys or receives/shares for commercial purposes the personal information of 100,000 or more California consumers
- Derives 50% or more of its annual revenue from selling personal information or performing targeted advertising using personal information
CPRA is not a radical change of rules and regulations. It is more like CCPA 2.0, with added regulations regarding data privacy. Here’s a side-by-side comparison:
CCPA
CPRA
Important Change
- Have revenues exceeding $25 million
- Annually sell, buy, or receive personal information of 50,000 or more California consumers for commercial purposes
- Derive 50% or more of its annual revenue from selling personal information
- Annual gross revenues exceeding $25 million
- Annually sell, buy, receive, or share personal information of 100,000 or more California consumers for commercial purposes
- Derive 50% or more of its annual revenue from selling or performing targeted advertising using personal information
The CPRA also adds a new category of information called sensitive personal information (SPI) that increases the compliance scope compared to CCPA. The following are some examples of SPIs:
- Union Membership
- Philosophical beliefs
- Login ID and Password
- Government identity information
- Immigration or citizenship status
- Precise geolocation
- Race and ethnicity
- Religious beliefs
- Sexual orientation
- Health and medical history
- Genetic data
Under the terms of the CCPA, consumers may bring a private action against an organization when certain types of personal information get breached (in a format that’s not encrypted or redacted). These types of information are limited to a person’s last name and first name (or initials), in combination with a unique identifier.
CPRA includes a person’s username and password that would permit access to an online account.
- The right to know what consumer personal information is collected by businesses.
- The right to access personal information.
- The right to say no to the sale of personal information.
- The right to know whether their personal information is sold or disclosed and to whom such information is sold or disclosed.
- The right to equal service and price, even if privacy rights are invoked.
- The right to correct inaccuracies.
- The right to limit how sensitive personal information is used and shared.
- The right to opt-out of targeted advertising.
- Correct inaccurate personal information in addition to deletion.
- Limit the use of SPI (sensitive personal information) as defined by CPRA.
- Have revenues exceeding $25 million
- Annually sell, buy, or receive personal information of 50,000 or more California consumers for commercial purposes
- Derive 50% or more of its annual revenue from selling personal information
- Annual gross revenues exceeding $25 million
- Annually sell, buy, receive, or share personal information of 100,000 or more California consumers for commercial purposes
- Derive 50% or more of its annual revenue from selling or performing targeted advertising using personal information
The CPRA also adds a new category of information called sensitive personal information (SPI) that increases the compliance scope compared to CCPA. The following are some examples of SPIs:
- Union Membership
- Philosophical beliefs
- Login ID and Password
- Government identity information
- Immigration or citizenship status
- Precise geolocation
- Race and ethnicity
- Religious beliefs
- Sexual orientation
- Health and medical history
- Genetic data
Under the terms of the CCPA, consumers may bring a private action against an organization when certain types of personal information get breached (in a format that’s not encrypted or redacted). These types of information are limited to a person’s last name and first name (or initials), in combination with a unique identifier.
CPRA includes a person’s username and password that would permit access to an online account.
- The right to know what consumer personal information is collected by businesses.
- The right to access personal information.
- The right to say no to the sale of personal information.
- The right to know whether their personal information is sold or disclosed and to whom such information is sold or disclosed.
- The right to equal service and price, even if privacy rights are invoked.
- The right to correct inaccuracies.
- The right to limit how sensitive personal information is used and shared.
- The right to opt-out of targeted advertising.
- Correct inaccurate personal information in addition to deletion.
- Limit the use of SPI (sensitive personal information) as defined by CPRA.
With Skyflow Data Privacy Vault as part of your architecture, you can isolate sensitive data to a single data source and protect it with polymorphic encryption and other privacy-enhancing technologies. With only one centralized personal information source, you can be confident that the access and usage of data is consistently enforced according to your policies.
Responding to any sensitive data requests becomes a matter of making one API call. Say goodbye to manual processes!
The United States doesn’t have a national law that regulates sensitive data. Five states have passed consumer privacy laws: California (CCPA, CPRA), Colorado (ColoPA), Connecticut (CDPA), Virginia (VCDPA), and Utah (UCPA). Currently, 27 other states have draft bills that could soon become law.
Privacy regulation can feel a lot to handle, even when these laws apply only to people who live in specific states. But fear not. If you take a privacy-first approach to handling personal information, you can easily comply with existing and new privacy regulations from anywhere in the United States or worldwide.
Yes. California privacy laws (CCPA & CPRA) are modeled after the EU’s GDPR. See the comparison chart below to see how they are similar and how they are different:
CCPA
GDPR
- Have revenues exceeding $25 million
- Annually sell, buy, receive, or share personal information of 100,000 or more California consumers for commercial purposes
The bottom line is: if you are aligning with either CPRA or GDPR, maintaining compliance with both of them is straightforward. See how Skyflow can help organizations of all sizes simplify and accelerate GDPR compliance.
- Have revenues exceeding $25 million
- Annually sell, buy, receive, or share personal information of 100,000 or more California consumers for commercial purposes
.svg)