What is the primary objective of CCPA?

The primary objective of the CCPA is to grant California residents rights over their personal information, including the right to know, delete, opt-out of sales/sharing, correct, and limit use of sensitive personal information. Enacted in 2018 and amended by CPRA effective 2023, it rebalances power by requiring businesses to provide notices at collection, handle data subject requests within 45 days (extendable to 90), and implement reasonable security.

Who is legally or professionally required to comply with CCPA?

For-profit businesses doing business in California must comply if they meet any threshold: annual gross revenue over $25 million, buy/sell/share personal information of 100,000+ consumers/households/devices annually, or derive 50%+ revenue from selling/sharing such data. This applies extraterritorially to global entities processing California residents' data, including post-CPRA employee and B2B data.

Does CCPA require an external audit or third-party certification?

No, CCPA does not mandate external audits or third-party certification. Businesses must maintain internal records of requests and responses for 24 months, conduct periodic privacy audits, and implement reasonable security; high-revenue firms face phased cybersecurity audits starting in 2026, but enforcement relies on CPPA investigations and self-demonstrated compliance.

How often should an assessment for CCPA be performed?

CCPA assessments should be performed annually to reassess thresholds and compliance gaps. Data inventories, risk assessments for high-risk processing (mandatory by 2026), and vendor audits must be ongoing, with privacy policies updated yearly to reflect 12-month practices and regulatory changes like CPRA amendments.

What are the consequences of non-compliance with CCPA?

Non-compliance with CCPA incurs fines of $2,500 per unintentional violation and $7,500 per intentional violation, enforced by the CPPA and Attorney General. A private right of action allows $100-$750 per consumer per breach incident for unencrypted data due to inadequate security, plus examples like Zoom's $85M settlement and Sephora's $1.2M fine.

Can CCPA be mapped to other international frameworks?

Yes, CCPA maps effectively to frameworks like GDPR through shared elements such as data subject rights, data mapping, and vendor contracts. Overlaps include access/deletion requests (45-day timelines), purpose limitation, and security obligations, enabling unified programs via tools like DPIAs for scalable compliance.

What is the first step to begin implementing CCPA?

The first step is conducting a legal applicability assessment against the three thresholds and a comprehensive data inventory. Map personal information flows, collection points, vendors, and retention to identify gaps, followed by prioritized notices and consumer request workflows.

What is the primary objective of ISO 27018?

ISO 27018 provides a code of practice for protecting Personally Identifiable Information (PII) in public clouds where the provider acts as a PII processor. It extends ISO 27001 and ISO 27002 with ~25–30 privacy-specific controls addressing cloud risks like multi-tenancy, subprocessors, consent, purpose limitation, data minimization, breach notification, and restrictions on secondary PII use (e.g., no marketing without consent). The standard aligns with ISO 27002:2022, emphasizing transparency and accountability for CSPs.

Who is legally or professionally required to comply with ISO 27018?

ISO 27018 applies to public cloud service providers (CSPs) acting as PII processors, not controllers. Targeted at hyperscalers, regional platforms, and sector-specific clouds (e.g., health, finance), it is a professional best practice for demonstrating processor obligations. No legal mandate exists, but it is expected by customers, regulators (e.g., GDPR Article 28), insurers, and procurement in regulated sectors for trust and risk transfer.

Does ISO 27018 require an external audit or third-party certification?

ISO 27018 does not offer standalone certification; controls are assessed within ISO 27001 audits by accredited bodies under ISO/IEC 17021 and ISO/IEC 27006. Auditors review implementation in the Statement of Applicability (SoA) during Stage 1 (documents) and Stage 2 (effectiveness) audits. Certificates reference both standards, valid for 3 years with annual surveillance.

How often should an assessment for ISO 27018 be performed?

ISO 27018 assessments occur via annual surveillance audits post-certification, with full recertification every 3 years as part of the ISO 27001 cycle. Internal risk assessments and gap analyses should be continual, integrated into the ISMS to address changes in cloud services, subprocessors, or regulations.

What are the consequences of non-compliance with ISO 27018?

Non-compliance with ISO 27018 risks loss of market trust, procurement delays, cyber insurance issues, and failure to meet processor obligations under laws like GDPR. As a code of practice, it carries no direct fines, but gaps in PII controls can lead to contractual breaches, regulatory scrutiny, or liability for controllers relying on the CSP.

An ISO 27018 be mapped to other international frameworks?

Yes, ISO 27018 maps directly to ISO 27001 Annex A (93 controls), ISO 27002:2022, ISO 27017 (cloud security), and ISO 27701 (PIMS). It aligns with GDPR Article 28 processor duties, OECD guidelines, and ISO/IEC 29100 privacy principles, enabling unified ISMS implementation without separate systems.

What is the first step to begin implementing ISO 27018?

Conduct a gap analysis of current ISMS against ISO 27018 controls, assuming ISO 27001 foundation. Map PII processing scope, review policies/contracts/subprocessors, and produce a Statement of Applicability with remediation roadmap prioritizing transparency, breach notification, and data subject rights support.

Standards Comparison

CCPA vs ISO 27018

CCPA

Mandatory

2020

California law granting residents data privacy rights

ISO 27018

Voluntary

2019

International code of practice for PII protection in public clouds

Quick Verdict

CCPA mandates consumer privacy rights for California businesses handling resident data, enforced by fines and lawsuits. ISO 27018 provides voluntary cloud PII controls for processors, certified via ISO 27001 audits. Companies adopt CCPA for legal compliance, ISO 27018 for trust and procurement edge.

Data Privacy

CCPA

California Consumer Privacy Act (CCPA/CPRA)

Cost

€€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Consumer rights to know, delete, opt-out, correct personal data
Threshold-based applicability: $25M revenue or 100K consumers/devices
Mandatory notices at collection and comprehensive privacy policy
Limits use of sensitive personal information like biometrics
Honors Global Privacy Control for frictionless opt-outs

Cloud Privacy

ISO 27018

ISO/IEC 27018 Code of practice for PII in public clouds

Cost

€€€

Complexity

Medium

Implementation Time

6-12 months

Key Features

PII protection controls for public cloud processors
Extends ISO 27001 with 25-30 privacy-specific controls
Mandates subprocessor transparency and location disclosure
Requires prompt customer breach notifications
Enforces data minimization and secure deletion

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

CCPA Details

What It Is

California Consumer Privacy Act (CCPA), as amended by California Privacy Rights Act (CPRA), is a state regulation granting California residents rights over personal information. It applies extraterritorially to for-profit businesses meeting thresholds, using a rights-based approach with consumer opt-outs and strict disclosures.

Key Components

Core consumer rights: know/access, delete, opt-out of sales/sharing, correct, limit sensitive PI.
Notices at collection, privacy policies, vendor contracts, data mapping.
Built on broad personal information definition including inferences, households, devices.
Enforcement by CPPA and Attorney General; no certification, but audits required.

Why Organizations Use It

Mandatory compliance avoids fines up to $7,500 per violation and breach litigation ($100-$750 per consumer).
Enhances trust, data governance, efficiency; aligns with GDPR for global ops.
Reduces breach risks, enables market differentiation in privacy-conscious sectors.

Implementation Overview

Phased: scoping/gap analysis (0-3 months), policies/contracts (1-4 months), technical controls (2-6 months), operationalization/audits.
Targets large data handlers in tech, retail, finance; cross-functional teams needed.
Ongoing monitoring, no formal certification but internal/external audits essential.

ISO 27018 Details

What It Is

ISO/IEC 27018 is an international code of practice extending ISO 27001 for protecting personally identifiable information (PII) in public clouds where providers act as PII processors. It targets multi-tenant environments, using a risk-based approach with privacy-specific controls and guidance aligned to ISO 27002:2022.

Key Components

Adds ~25–30 privacy controls to ISO 27001 Annex A (93 controls in organizational, people, physical, technological themes)
Principles: consent, purpose limitation, data minimization, accuracy, retention limits, security, transparency, accountability
Assessed via Statement of Applicability in ISO 27001 audits; no standalone certification

Why Organizations Use It

Builds customer trust and accelerates procurement
Aligns with GDPR Art. 28, HIPAA processor duties
Enables subprocessor transparency, breach notification
Differentiates CSPs, aids cyber insurance, reduces outsourcing risks

Implementation Overview

Integrate into existing ISO 27001 ISMS via gap analysis, SoA updates
Key activities: technical safeguards (encryption, logging), training, contracts
Suits CSPs all sizes; accredited audits with annual surveillance

Frequently Asked Questions

Common questions about CCPA and ISO 27018

CCPA FAQ

ISO 27018 FAQ

You Might also be Interested in These Articles...

The CIS Controls v8.1 Evidence Pack: What Auditors Ask For (and How to Produce Proof Fast)

Fail CIS Controls v8.1 audits due to missing evidence? Get the blueprint: exact artifacts auditors want, repository structure, and automation from security tool

The DORA 'Hot Seat' Blueprint: Preparing Leadership and the Management Body for Regulatory Interviews

Prepare your Board & Management Body for DORA audits. Master the human element: demonstrate active oversight & accountability in regulatory interviews. Get the

NIST 800-53 Private Sector ROI Reality Check: Isolating Control Family Impacts on 2024 Breach Costs

Discover NIST 800-53 ROI in private sector: control families like RA, SI, SR reduce median breach costs from $100K to under $50K. Get benchmarks to prioritize i

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Explore More Comparisons

See how CCPA and ISO 27018 compare against other standards

Other CCPA Comparisons

Other ISO 27018 Comparisons

Quick Verdict

What It Is

Key Components

Core consumer rights: know/access, delete, opt-out of sales/sharing, correct, limit sensitive PI.

Notices at collection, privacy policies, vendor contracts, data mapping.

Built on broad personal information definition including inferences, households, devices.

Enforcement by CPPA and Attorney General; no certification, but audits required.

Implementation Overview

Phased: scoping/gap analysis (0-3 months), policies/contracts (1-4 months), technical controls (2-6 months), operationalization/audits.

Targets large data handlers in tech, retail, finance; cross-functional teams needed.

Ongoing monitoring, no formal certification but internal/external audits essential.

What It Is

Key Components

Adds ~25–30 privacy controls to ISO 27001 Annex A (93 controls in organizational, people, physical, technological themes)

Principles: consent, purpose limitation, data minimization, accuracy, retention limits, security, transparency, accountability

Assessed via Statement of Applicability in ISO 27001 audits; no standalone certification