Organizations who plan on manually processing CCPA data subject requests (DSRs) or data subject access requests will spend between $140k – $275k per million consumer records they have in their systems, according to DataGrail.
The CCPA went into effect on January 1, 2020, giving consumers the right to know the data collected about them, to delete data about them, and ensure their data is not sold to third-parties. The report analyzed the number of requests in Q1 2020 to understand how CCPA will impact organizations in the long-run.
The early learnings from the first few months of CCPA should help businesses plan and predict the future of privacy regulation.
- Privacy headlines (and COVID-related emails) in March & April likely drove an increase of CCPA privacy requests.
- B2C companies should prepare to process approximately 100 to 194 requests per million consumer records each year.
- Processing CCPA privacy requests will likely cost B2C companies $140,000 to $275,000 per one million consumer records, if done manually.
- Deletion requests were the most popular requests (40%) in Q1 2020, followed by DNS (33%), and access requests (27%).
- Do Not Sell (DNS) requests will likely become the most dominant privacy request after analyzing early trending data.
CCPA privacy requests expected to stabilize
Looking forward to the remainder of 2020, the number of CCPA privacy requests is expected to stabilize around the February and March numbers (8 requests per million consumer records).
In July and August we may see a surge once again as CCPA enforcement begins on July 1, 2020.
DNS requests expected to dominate
DNS requests will likely dominate, with deletion requests not far behind, which means companies should prepare for the complex task of reaching out to their network of processors and sub processors to successfully perform a hard delete. New regulations cause a lot of uncertainty and anxiety – especially when they involve a lot of complexity and associated fines.