Business Law Journal

[This is the second in a series of blog posts on how businesses should prepare for the California Privacy Rights Act which will enter into force on January 1, 2023]

When the California Privacy Rights Act (“CPRA”) takes effect on January 1, 2023 it will bring sweeping changes to data retention requirements in California.^[1]  Historically, many companies have over-retained data (and understandably so, since most risks under older laws related to a failure to keep data).  The CPRA changes the data-retention landscape significantly by requiring companies to justify and disclose their retention policies, and to limit retention periods to only the time necessary to fulfill the company’s disclosed purpose for retaining.

[1] Final regulations under the CPRA are still pending and the information provided herein is subject to modification. This guidance also does not cover data retention principles under statutes other than CPRA.