Does the CPRA require companies to publish the data retention period that applies to the personal information it collects from consumers?

By David A. Zetoony on November 9, 2020

Yes.

Most privacy laws in the United States do not require that a company publicly disclose the length of time that personal information will be kept. While the CCPA did not contain such a requirement, the CPRA will require, beginning on January 1, 2023, that businesses inform consumers at the point at which information is collected of the “length of time the business intends to retain each category of personal information” that it collects.[1] If it is not possible for a business to provide consumers with a specific retention period, the business is instructed to disclose “the criteria used to determine such period. . . .”[2]

1] CPRA, 1798.100(a)(3).

[2] CPRA, 1798.100(a)(3).

Data Privacy Dish

Does the CPRA require companies to publish the data retention period that applies to the personal information it collects from consumers?

About Greenberg Traurig