CCPA
California regulation granting consumers data privacy rights
AS9120B
Aerospace QMS standard for parts distributors.
Quick Verdict
CCPA mandates privacy rights for California consumers, requiring data notices, opt-outs, and breach security. AS9120B certifies aerospace distributors for traceability and counterfeit prevention. Companies adopt CCPA to avoid fines; AS9120B for market access and supply chain trust.
CCPA
California Consumer Privacy Act (CCPA/CPRA)
Key Features
- Consumer rights to know, delete, correct, opt-out of sales/sharing
- Applies via thresholds: $25M revenue or 100K+ CA residents/devices
- Requires 'Do Not Sell or Share' links and GPC signals
- Right to limit sensitive personal information usage
- Private right of action for security breaches
AS9120B
AS9120B Quality Management Systems - Requirements
Key Features
- Counterfeit and suspected unapproved parts prevention
- Traceability and chain-of-custody controls for split lots
- Risk-based external provider evaluation and monitoring
- Configuration management via sales order records
- Enhanced preservation and product identification requirements
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
CCPA Details
What It Is
California Consumer Privacy Act (CCPA), amended by California Privacy Rights Act (CPRA), is a state regulation granting California residents rights over personal information. It targets for-profit businesses meeting thresholds, using a rights-based, risk-proportionate approach for data governance and compliance.
Key Components
- Consumer rights: know/access, delete, correct, opt-out sales/sharing, limit sensitive PI
- Thresholds: $25M revenue, 100K+ consumers/devices, 50% data revenue
- Obligations: notices/policies, DSAR handling (45-90 days), GPC honoring, vendor controls, security
- Enforcement model: CPPA/AG fines ($2,500-$7,500/violation), private breach actions; no certification
Why Organizations Use It
- Avoids regulatory fines, litigation from breaches
- Enhances data governance, reduces breach risks
- Builds consumer trust, enables market differentiation
- Aligns with GDPR, supports multi-state compliance
Implementation Overview
Phased: scoping (0-3 months), policies/contracts (1-4m), technical systems (2-6m), training/audits (ongoing). Applies globally to CA data handlers; cross-functional, tool-intensive for enterprises.
AS9120B Details
What It Is
AS9120B is the IAQG quality management system standard for aerospace distributors, based on ISO 9001:2015's 10-clause structure. It establishes requirements for organizations procuring, storing, and reselling parts without alteration, emphasizing risk-based thinking to address distribution risks like traceability loss and counterfeits.
Key Components
- Over 100 aerospace-specific requirements beyond ISO 9001.
- Core areas: context analysis, leadership, planning, support, operations (traceability, counterfeit prevention, supplier controls), performance evaluation, improvement.
- Built on PDCA cycle; requires documented information, not full procedures.
- Certification via accredited bodies, leading to OASIS listing.
Why Organizations Use It
- Commercial necessity for OEM/Tier-1 supply chains.
- Mitigates risks of nonconformities, enhances chain-of-custody trust.
- Drives efficiency, market access (2,442 global certifications), competitive edge.
Implementation Overview
- Phased: gap analysis, process design, training, audits (6-12 months).
- Applies to aviation/space/defense distributors globally.
- Involves internal audits, management reviews, Stage 1/2 certification.
Key Differences
| Aspect | CCPA | AS9120B |
|---|---|---|
| Scope | Consumer privacy rights and data handling | Aerospace distributor quality management |
| Industry | All businesses handling CA resident data | Aerospace parts distributors globally |
| Nature | Mandatory state regulation with enforcement | Voluntary certification standard |
| Testing | Internal audits and consumer request handling | Third-party certification audits |
| Penalties | $2,500-$7,500 per violation, private actions | Loss of certification, market exclusion |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about CCPA and AS9120B
CCPA FAQ
AS9120B FAQ
You Might also be Interested in These Articles...
From Data Fragments to Strategic Insight: Powering Intelligent Risk Management with Integrated Compliance Monitoring
Transform data fragments into strategic insights with integrated compliance monitoring. Automate real-time risk management, ensure GDPR & SOC 2 compliance, and
SOC 2 Trust Services Criteria in Plain English: Side-by-Side Decoder for Security, Availability, and Beyond
Decode AICPA Trust Services Criteria from auditor jargon to plain English with side-by-side tables, analogies & TL;DRs. CISOs & founders: implement SOC 2 contro
Top 10 SOC 2 Mistakes Startups Make (and Fixes with Automation)
Avoid top 10 SOC 2 mistakes like scope creep & evidence gaps. See fail/pass visuals, client quotes, Vanta/Drata automation fixes for bootstrapped startups. Quic
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
C-TPAT vs ISO 21001
Compare C-TPAT vs ISO 21001: Secure supply chains with CBP benefits via C-TPAT; optimize education for learner success with ISO 21001. Uncover differences, implementation tips now! (152 characters)
AS9110C vs ISO 30301
Discover AS9110C vs ISO 30301: Aerospace QMS for aviation maintenance meets records management mastery. Compare HLS structures, risks, ops controls & certification paths. Boost compliance now!
ISO 37001 vs EN 1090
ISO 37001 vs EN 1090: Compare anti-bribery ABMS with steel/aluminium structural standards. Key differences, compliance benefits & implementation guide. Boost ethics & safety now!