California Administrative Code

(a) The goal of a risk assessment is restricting or prohibiting the processing of personal information if the risks to privacy of the consumer outweigh the benefits resulting from processing to the consumer, the business, other stakeholders, and the public.

(a) A business must comply with the following timing requirements for conducting and updating its risk assessments: (1) A business must conduct and document a risk assessment in accordance with the requirements of this Article before initiating any processing activity identified …

(a) Timing of Risk Assessment Submissions. (1) For risk assessments conducted in 2026 and 2027, the business must submit to the Agency the information required by subsection (b) no later than April 1, 2028. (2) For risk assessments conducted after 2027, the business must submit t…

(a) Probable Cause. Under Civil Code section 1798.199.50, probable cause exists when the evidence supports a reasonable belief that the CCPA has been violated. (b) Probable Cause Notice. The Agency will provide the alleged violator with notice of the probable cause proceeding as …

(a) At any time before or during an administrative hearing and in lieu of such a hearing, the Head of Enforcement and the alleged violator may stipulate to the entry of a final order. If a stipulation has been agreed upon and the scheduled date of the hearing is set to occur befo…

(a) Scope. The Agency may audit a business, service provider, contractor, or person to ensure compliance with any provision of the CCPA. (b) Criteria for Selection. The Agency may conduct an audit to investigate possible violations of the CCPA. Alternatively, the Agency may condu…

(a) User training shall only be conducted by the Department or an instructor certified by the Department. Requirements to become a certified instructor are set forth in section 752. (b) At a minimum, instruction from the Department or a certified instructor shall address the foll…

(a) A person shall meet all of the following minimum qualifications to become a certified instructor of User training: (1) The person has graduated from the training outlined in subdivision (b) of section 751.6. (2) The person has User experience and demonstrated proficiency with…

(a) After an organization has been designated as a criminal street gang in the CalGang database, a User may add legally obtained information to that designated criminal street gang, including, but not limited to: known gang addresses; associated cliques; history of the gang; comm…

(a) A juvenile's record shall be retained in the CalGang database for three years, and upon termination of the retention period, the record shall be automatically purged from the database. (b) If a minimum of two additional criteria is added to a person's record in the CalGang da…

(a) At least three times per calendar year, Node Administrators shall conduct Peer Audits on a sample of randomly selected records from within their Node. Peer Audit assignments shall be randomly assigned by the Department and shall be completed within 60 calendar days from the d…

(a) Attestation Required by the Department. In connection with, or in lieu of, auditing the records or criminal street gang designations of a particular Node Agency or User Agency, the Department may require the Node Agency or User Agency to review any or all of its entries in th…

(a) Release of criminal intelligence information in the CalGang database is on a right to know and need to know basis only. Nothing in this subdivision limits the sharing of information in the CalGang database if permitted by section 753.6 or 754, or Penal Code section 186.34 or …

(a) After a data broker accesses the DROP for the first time, the data broker must, at each subsequent access session, report the status of every deletion request received during the previous access session. If a data broker re-downloaded a complete consumer deletion list, the da…

(a) The annual fee to register as a data broker is $6,000 plus an associated third-party fee for processing electronic payments not to exceed 2.99%. (b) Data brokers are required to pay the registration fee by credit card during the registration period via the Agency's website at…

In addition to the definitions set forth in Civil Code sections 1798.99.80 and 1798.140, the following definitions apply to this Chapter: (a) “Access the Delete Request and Opt-out Platform (‘DROP’)” means a data broker retrieves a consumer deletion list in compliance with Civil …

(a) A business, regardless of its status as a parent company or subsidiary of another business, which independently meets the definition of “data broker” as set forth in Civil Code section 1798.99.80 for any period of time during the previous calendar year must register during th…

(a) A data broker's disclosure of metrics required by Civil Code section 1798.99.82(b)(2)(G) and 1798.99.85 must comply with section 7003, where applicable and technically feasible.

(a) Prior to accessing the DROP for the first time, a data broker shall utilize the Agency's website found at www.cppa.ca.gov to create a DROP account. To create an account, a data broker must: (1) Establish a secure username and password (“credentials”) and maintain its account …

(a) A data broker must access the DROP to download its selected consumer deletion list(s) at least once every 45 calendar days. (b) A data broker may access the DROP manually or through automated means in formats supported by the DROP. If a data broker is unable to timely downloa…

(a) Upon accessing the DROP in accordance with section 7612, a data broker must do the following to process deletion requests in compliance with Civil Code section 1798.99.86: (1) Compare the consumer identifier information contained in each consumer deletion list with the applic…

(a) A consumer must submit their deletion request through the DROP. A consumer will have their California residency verified by the Agency prior to submitting a deletion request. If the Agency cannot verify the consumer's residency, the consumer cannot submit a deletion request t…

If any information submitted in the original application or subsequent renewal application changes, or in the event of any change in ownership, management, or employment from the original or renewal application, the permittee shall notify the Department in writing within 15 calen…

(a) Once instruction is completed, all Users shall take an initial certification exam on the curriculum described in subdivision (b) of section 771 in a manner prescribed by the System Administrator or the System Administrator's Designee. (b) Every 12 months after the date of ini…

(a) A person shall meet all of the following minimum qualifications to become a certified instructor of User training: (1) The person has graduated from the training outlined in subdivision (b) of section 771. (2) The person has User experience and demonstrated proficiency with t…

(a) No persons under the age of 13 shall be entered into a shared gang database. (b) A person shall not be designated as a Gang Member or Associate without the law enforcement agency having reasonable suspicion that the person actively participates in a criminal street gang with …

(a) No entry shall be made in a shared gang database unless all related intelligence data is first meaningfully reviewed and approved by the appropriate supervisory classification pertinent to the organizational structure of the User Agency. In addition to the first-level supervi…

(a) No entry shall be made in a shared gang database unless all related criminal street gang intelligence data is first meaningfully reviewed and approved by the appropriate supervisory classification pertinent to the organizational structure of the User Agency. In addition to th…

(a) Pursuant to subdivision (c) of Penal Code section 186.34, a person, and at least one parent or guardian of the person if the person is a juvenile, shall be notified of the person's inclusion in a shared gang database in writing prior to the person being entered into a shared …

A User Agency shall maintain copies of each notification to a recipient that was issued pursuant to subdivision (c) of Penal Code section 186.34, and the related documentation required under section 773, for the length of time a record about the person to whom the notice pertains…

(a) “Affiliated” means that a person is an employee of a Nonprofit Bona Fide Research Institution, and is not a consultant or independent contractor for a Nonprofit Bona Fide Research Institution. (b) “Aggregated Data” means data that does not include Personal Identifying Informa…

(a) Printing privileges may be granted at the discretion of each System Administrator. Users shall demonstrate a compelling need to export or print database information before print privileges are extended. For example, a User who wants to generate a photo lineup to display to a …

(a) Information on a person or organization shall be excluded from a shared gang database if the information is collected merely on the basis: (1) Of race, gender, age, or ethnic background. (2) Of religious or political affiliations or beliefs. (3) Of personal habits or predilec…

Any act by any employee or other individual on behalf of the permitted individual or company which constitutes a violation of Chapter 3 of Division 10 of the Health and Safety Code shall constitute grounds for revocation or denial of the permit.

(a) Within 30 days after the date of receipt of an application, the Department shall either inform the applicant, in writing, that the application is complete and accepted for filing, or return the application as deficient and specify what information is required. Within 180 days…

Each citation: (a) shall be in writing; (b) shall describe with particularity the nature of the violation, including specific reference to the provision of law or specific regulation determined to have been violated; (c) may contain an administrative fine, an order of abatement a…

(a) The fine for an initial violation shall be a maximum of $1,000 per individual violation. (b) The fine for a subsequent violation shall be a maximum of $2,500 per individual violation. (c) A third violation may result in the filing of an administrative disciplinary action seek…

(a) A Prescriber who possesses a valid DEA Registration Certificate for a practice location in California must register for access to CURES. (b) A Prescriber who possesses a valid DEA Registration Certificate for a practice location only in a state or states other than California…

(a) “Prescriber Registration Application,” when used in this section, means the Web-form application developed by the Department, under Health and Safety Code section 11165.1, subdivision (a)(1)(A)(i), for a Prescriber or Out-of-State Prescriber to obtain approval to electronical…

(a) A Non-DEA Practitioner may register for access to CURES. (b) If an individual who is registered for access to CURES as a Non-DEA Practitioner is no longer eligible for access to CURES under this section, the individual must not access CURES.

(a) “Non-DEA Practitioner Registration Application,” when used in this section, means the Web-form application developed by the Department, under Health and Safety Code section 11165.1, subdivision (a)(1)(A)(iii), for a Non-DEA Practitioner to obtain approval to electronically ac…

(a) An Authorizing User is responsible for all access and use of CURES by a Delegate-User to whom that Authorizing User has delegated authority under this article, including the Delegate-User's compliance with the requirements of this article. (b) A Delegate-User must only access…

(a) A Delegate-User may access the Web-Based Application. (b) A Compliant Password may be changed in the Web-Based Application. A Delegate-User must create a Compliant Password every 90 days. (c) Procedure to Complete an Annual Renewal. (1) An Annual Renewal may be completed in t…

(a) An Interstate-User is eligible to request data from CURES through that Interstate-User's PDMP if all of the following requirements are met: (1) The Interstate-User's PDMP has entered into a memorandum of understanding with the Department for interstate sharing of data from CU…

(a) Subject to the restrictions of section 825.3, an Interstate-User may obtain a Patient Activity Report. (b) An Interstate-User may access data in CURES for a Search Period not to exceed 24 months from the date of the search.

(a) A Regulatory Agency Official must not use, disclose, or transfer data obtained from CURES unless the use, disclosure, or transfer is consistent with both of the following: (1) Unless otherwise required by law, the use, disclosure, or transfer is for the same authorized purpos…

(a) “Law Enforcement Official Registration Application,” when used in this section, means the Web-form application developed by the Department for a Law Enforcement Official to obtain approval to electronically access CURES. (b) An applicant must electronically submit the Law Enf…

(a) A public or private entity is eligible to obtain data from CURES, subject to the limitations specified in section 828.2. (b) A Bona Fide Researcher is eligible to obtain data from CURES.

(a) An individual may obtain that individual's prescription history information retained in CURES from CURES PDMP. (b) In accordance with subdivisions (b)(1) and (b)(2), an authorized personal representative, on behalf of an individual, may obtain that individual's prescription h…

§ 1934. Well Spacing. [Repealed] This database is current through 5/1/26 Register 2026, No. 18. Source: https://govt.westlaw.com/calregs/Document/I546446B95B4D11EC976B000D3A7C4BC3?viewType=FullText&originationContext=documenttoc&transitionType=CategoryPageItem&contextData=(sc.Def…