Now liveThe Skillselion MCP - thousands of ranked skills, loaded into your agent mid-task. No install.Get it →
borghei avatar

Ccpa Cpra Privacy Expert

borghei/claude-skills

  • 80 installs
  • 451 repo stars
  • Updated July 21, 2026
  • borghei/claude-skills

ccpa-cpra-privacy-expert is a skill that audits organizations for CCPA/CPRA compliance and maps personal-information flows.

About

This skill audits organizations for CCPA and CPRA compliance and maps their personal-information flows. Its compliance checker scores readiness across categories like privacy policy, consumer rights, and opt-out mechanisms, and its data mapper tracks the 11 CCPA PI categories and sensitive PI. Teams use it for California privacy assessments, data mapping, and privacy policy review.

  • Audits organizations against CCPA/CPRA requirements with a 0-100 compliance score
  • Maps all 11 CCPA personal information categories and flags sensitive PI
  • Ships a compliance checker and a data mapper with a 6-month implementation roadmap

Ccpa Cpra Privacy Expert by the numbers

  • 80 all-time installs (skills.sh)
  • Ranked #1,098 of 2,203 Security skills by installs in the Skillselion catalog
  • Data as of Aug 5, 2026 (Skillselion catalog sync)
At a glance

ccpa-cpra-privacy-expert capabilities & compatibility

Capabilities
compliance audit · data mapping · privacy policy review
Use cases
security audit · research
Pricing
Free
From the docs

What ccpa-cpra-privacy-expert says it does

Audits organizations for California privacy law compliance, maps personal information flows, validates consumer rights readiness, and checks technical safeguards.
SKILL.md
Maps all 11 CCPA personal information categories
SKILL.md
Overall compliance score (0-100)
SKILL.md
npx skills add https://github.com/borghei/claude-skills --skill ccpa-cpra-privacy-expert

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

Listed on Skillselion
Installs80
repo stars★ 451
Last updatedJuly 21, 2026
Repositoryborghei/claude-skills ↗

What it does

Audit and document CCPA/CPRA privacy compliance and map personal-information flows for a California-facing product.

Who is it for?

Teams doing California privacy assessments, CPRA readiness checks, data mapping, or privacy policy review.

Skip if: GDPR-only or non-California privacy programs as the primary framework.

When should I use this skill?

You need a CCPA/CPRA compliance assessment, data map, or consumer-rights readiness check.

What you get

A scored compliance report with prioritized findings and a data inventory covering all CCPA PI categories.

  • compliance score report
  • data inventory
  • data flow diagram

By the numbers

  • compliance score 0-100
  • maps all 11 CCPA personal information categories
  • 6-month implementation roadmap

Files

SKILL.mdMarkdownGitHub ↗

CCPA/CPRA Privacy Expert

Tools and guidance for California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) compliance.

---

Table of Contents

---

Tools

CCPA Compliance Checker

Evaluates organizational readiness against all CCPA/CPRA requirements. Validates privacy policies, consumer rights handling, technical safeguards, and opt-out mechanisms.

# Check compliance from a JSON profile
python scripts/ccpa_compliance_checker.py --input company_profile.json

# Generate a blank input template
python scripts/ccpa_compliance_checker.py --template > company_profile.json

# JSON output for automation
python scripts/ccpa_compliance_checker.py --input company_profile.json --json

# Export report to file
python scripts/ccpa_compliance_checker.py --input company_profile.json --output report.json

Assessment Categories:

CategoryKey Checks
ApplicabilityRevenue threshold, consumer count, data selling revenue
Privacy PolicyRequired disclosures, update cadence, accessibility
Consumer RightsRequest handling, verification, timelines
Opt-Out Mechanisms"Do Not Sell" link, GPC signal, cookie consent
Sensitive PISPI categories, use limitation link, handling controls
Technical SafeguardsEncryption, access controls, security measures
Service ProvidersAgreement requirements, data processing terms
Risk AssessmentsAnnual audits, processing risk evaluations

Output:

  • Overall compliance score (0-100)
  • Per-category scores with pass/fail/partial status
  • Prioritized findings with regulatory references
  • Remediation recommendations

---

CCPA Data Mapper

Maps personal information categories, identifies sensitive personal information, tracks data flows across collection, use, sharing, and selling. Generates data inventory reports.

# Map data from a JSON data inventory
python scripts/ccpa_data_mapper.py --input data_inventory.json

# Generate a blank inventory template
python scripts/ccpa_data_mapper.py --template > data_inventory.json

# Export mapping report
python scripts/ccpa_data_mapper.py --input data_inventory.json --output mapping_report.json

# Generate data flow diagram (text-based)
python scripts/ccpa_data_mapper.py --input data_inventory.json --flow-diagram

Features:

  • Maps all 11 CCPA personal information categories
  • Identifies sensitive personal information (SPI) per CPRA definitions
  • Tracks data flows: collection sources, business purposes, sharing/selling recipients
  • Maps data to service providers, contractors, and third parties
  • Generates CCPA-compliant data inventory for privacy policy disclosures
  • Flags cross-border data transfers
  • Detects data retention gaps

Personal Information Categories Tracked:

CategoryCCPA SectionExamples
Identifiers1798.140(v)(1)(A)Name, SSN, IP address, email
Customer Records1798.140(v)(1)(B)Financial info, medical info
Protected Classifications1798.140(v)(1)(C)Race, sex, age, disability
Commercial Information1798.140(v)(1)(D)Purchase history, tendencies
Biometric Information1798.140(v)(1)(E)Fingerprints, face geometry
Internet Activity1798.140(v)(1)(F)Browsing, search, interaction
Geolocation Data1798.140(v)(1)(G)Precise location
Sensory Data1798.140(v)(1)(H)Audio, visual, thermal
Professional Info1798.140(v)(1)(I)Employment, education
Education Info1798.140(v)(1)(J)Non-public education records
Inferences1798.140(v)(1)(K)Profiles, preferences

---

Reference Guides

CCPA/CPRA Requirements Guide

references/ccpa-cpra-requirements-guide.md

Complete regulatory requirements covering:

  • Full CCPA/CPRA text analysis with section references
  • Consumer rights implementation guidance (Right to Know, Delete, Opt-Out, Correct, Portability, Limit SPI Use)
  • Privacy policy content requirements and templates
  • Service provider and contractor agreement requirements
  • Comparison with Virginia VCDPA, Colorado CPA, Connecticut CTDPA, and GDPR
  • Enforcement and penalty structure

CCPA Implementation Playbook

references/ccpa-implementation-playbook.md

Step-by-step implementation guidance:

  • 6-month implementation roadmap
  • Data mapping methodology and templates
  • Privacy policy drafting guide
  • Opt-out mechanism implementation (website, GPC, universal opt-out)
  • Consumer request workflow design with SLA tracking
  • Employee and vendor training program outline
  • Annual cybersecurity audit planning
  • Ongoing compliance monitoring

---

Workflows

Workflow 1: Initial CCPA/CPRA Compliance Assessment

Step 1: Determine applicability
        → Check $25M revenue, 100K+ consumers, 50%+ PI revenue thresholds
        → Review exemptions (HIPAA, GLBA, employment data)

Step 2: Generate compliance profile template
        → python scripts/ccpa_compliance_checker.py --template > profile.json
        → Fill in organizational details

Step 3: Run compliance assessment
        → python scripts/ccpa_compliance_checker.py --input profile.json

Step 4: Review scores and findings
        → Address critical gaps first (opt-out link, privacy policy)
        → Plan remediation by category

Step 5: Create data inventory
        → python scripts/ccpa_data_mapper.py --template > inventory.json
        → Document all PI categories collected
        → python scripts/ccpa_data_mapper.py --input inventory.json

Step 6: Develop implementation plan
        → See references/ccpa-implementation-playbook.md

Workflow 2: Consumer Rights Request Handling

Step 1: Receive consumer request
        → Identify request type (Know, Delete, Opt-Out, Correct, Portability, Limit SPI)

Step 2: Acknowledge within 10 business days (confirm receipt)
        → Document request in tracking system

Step 3: Verify consumer identity
        → Match 2+ data points for standard requests
        → Match 3+ data points for sensitive data requests
        → No verification needed for opt-out requests

Step 4: Fulfill request within 45 calendar days
        → Extension: up to 45 additional days with notice
        → Search all systems using data inventory
        → python scripts/ccpa_data_mapper.py --input inventory.json

Step 5: Deliver response
        → Provide information in portable format if requested
        → Document completion and response

Step 6: Monitor compliance
        → Track response times and completion rates
        → Generate quarterly compliance reports

Workflow 3: Privacy Policy Update Cycle

Step 1: Review current privacy policy against requirements
        → python scripts/ccpa_compliance_checker.py --input profile.json
        → Check privacy_policy category score

Step 2: Update data inventory
        → python scripts/ccpa_data_mapper.py --input inventory.json
        → Verify all PI categories are disclosed

Step 3: Verify required disclosures
        → Categories of PI collected (past 12 months)
        → Sources of PI
        → Business/commercial purposes
        → Categories of third parties
        → Consumer rights description
        → "Do Not Sell or Share" link
        → "Limit the Use of My Sensitive PI" link

Step 4: Update and publish
        → Annual update at minimum
        → Update within 30 days of material changes
        → Maintain prior version archive

---

Regulatory Overview

CCPA/CPRA Timeline

DateMilestone
Jan 1, 2020CCPA effective
Jul 1, 2020AG enforcement begins
Nov 3, 2020CPRA passed (Proposition 24)
Jan 1, 2023CPRA amendments effective
Jul 1, 2023CPPA enforcement of CPRA begins
2026Employment and B2B data exemptions status review

Scope and Applicability

A business is subject to CCPA/CPRA if it:

  • Has annual gross revenue exceeding $25 million
  • Buys, sells, or shares PI of 100,000+ consumers or households annually
  • Derives 50% or more of annual revenue from selling or sharing consumers' PI

Entity Types:

EntityDefinitionObligations
BusinessDetermines purposes and means of processingFull CCPA/CPRA compliance
Service ProviderProcesses PI on behalf of a business (contractual)Limited use, deletion obligations
ContractorProcesses PI via written contract (CPRA addition)Certification, limited use, audit rights
Third PartyReceives PI not as service provider/contractorSubject to opt-out rights

Exemptions:

  • HIPAA-covered entities: Health data governed by HIPAA exempt
  • GLBA: Financial data subject to GLBA exempt
  • Employment data: Employee/applicant PI (subject to review through 2026)
  • B2B data: Business contact PI in B2B transactions (subject to review through 2026)
  • FCRA: Data subject to Fair Credit Reporting Act

Consumer Rights

RightCCPA SectionDescriptionTimeline
Right to Know§1798.100, §1798.110Categories and specific pieces of PI collected45 days
Right to Delete§1798.105Delete PI collected from the consumer45 days
Right to Opt-Out§1798.120Opt out of sale or sharing of PIImmediate
Right to Non-Discrimination§1798.125No retaliation for exercising rightsOngoing
Right to Correct§1798.106Correct inaccurate PI (CPRA)45 days
Right to Limit SPI Use§1798.121Limit use of sensitive PI (CPRA)Immediate
Right to Data Portability§1798.130Receive PI in portable format (CPRA)45 days

Sensitive Personal Information (CPRA)

SPI categories requiring enhanced protections under CPRA §1798.140(ae):

  • Social Security number, driver's license, state ID, passport number
  • Account log-in credentials (username + password/security question)
  • Financial account number with access credentials
  • Precise geolocation (within 1,850 feet / radius)
  • Racial or ethnic origin
  • Religious or philosophical beliefs
  • Union membership
  • Contents of mail, email, and text messages (unless business is intended recipient)
  • Genetic data
  • Biometric data for identification
  • Health information
  • Sex life or sexual orientation data

Enforcement and Penalties

Violation TypePenaltyEnforcer
Unintentional violation$2,500 per violationCPPA / AG
Intentional violation$7,500 per violationCPPA / AG
Violations involving minors (under 16)$7,500 per violationCPPA / AG
Data breach (private action)$100-$750 per consumer per incidentConsumer (court)

Enforcement Bodies:

  • California Privacy Protection Agency (CPPA): Primary enforcer under CPRA (operational 2023)
  • California Attorney General: Retains enforcement authority
  • Private right of action: Limited to data breaches from failure to maintain reasonable security

CCPA vs GDPR Comparison

AspectCCPA/CPRAGDPR
ScopeCalifornia consumersEU/EEA data subjects
Legal basisOpt-out modelOpt-in (consent or legal basis)
Data coveredPersonal informationPersonal data
Sensitive dataSPI with limit-use rightSpecial category with explicit consent
Breach notificationAG notification, private action72-hour DPA notification
DPO requirementNoneRequired for certain processing
Penalties$2,500-$7,500 per violationUp to 4% global revenue or €20M
Private right of actionData breaches onlyVaries by member state
Cross-border transfersNo restrictionsAdequacy decisions, SCCs, BCRs
Children's dataOpt-in for under 16, parental for under 13Parental consent for under 16 (variable)

Infrastructure Privacy Controls

Cookie Consent Management:

  • Implement cookie consent banner for non-essential cookies
  • Honor Global Privacy Control (GPC) browser signals (legally required)
  • Maintain cookie inventory with retention periods
  • Categorize cookies: strictly necessary, functional, analytics, advertising

Global Privacy Control (GPC):

  • Businesses must treat GPC signal as valid opt-out request (§1798.135)
  • Technical implementation: detect Sec-GPC: 1 header or navigator.globalPrivacyControl
  • Apply opt-out to sale AND sharing of PI
  • No re-authentication required for GPC

Privacy by Design:

  • Data minimization: collect only PI necessary for disclosed purposes
  • Purpose limitation: use PI only for purposes disclosed at collection
  • Storage limitation: retain PI only as long as necessary
  • Security by default: encrypt PI at rest and in transit

Data Inventory and Mapping:

  • Maintain comprehensive PI inventory across all systems
  • Map data flows: collection → processing → sharing → deletion
  • Document retention schedules per PI category
  • Track cross-border data transfers

Automated Decision-Making:

  • Disclose use of automated decision-making technology
  • Provide opt-out for profiling that produces legal or significant effects
  • CPRA regulations may require access to logic of automated decisions

Compliance Roadmap

Month 1-2: Discovery and Assessment

  • Determine CCPA/CPRA applicability
  • Conduct data inventory and mapping
  • Gap analysis against requirements
  • Assign compliance ownership

Month 3-4: Implementation

  • Draft/update privacy policy
  • Implement "Do Not Sell or Share" link
  • Implement "Limit Use of SPI" link
  • Deploy GPC signal detection
  • Build consumer request intake and fulfillment workflows
  • Draft service provider/contractor agreements

Month 5-6: Operationalization

  • Train employees on privacy obligations
  • Test consumer request workflows end-to-end
  • Conduct initial risk assessment
  • Plan annual cybersecurity audit
  • Establish ongoing monitoring and metrics
  • Document compliance program for regulatory defense

---

Troubleshooting

ProblemPossible CauseResolution
Compliance score unexpectedly low despite privacy policy updatesPolicy disclosures incomplete -- missing SPI categories, retention periods, or sale/sharing categoriesRun ccpa_compliance_checker.py --input profile.json and review per-category scores; cross-reference privacy policy against the 17+ required disclosure elements
Data mapper flags cross-border transfers but organization operates only in USData inventory includes cloud services with non-US processing locationsReview data inventory entries for cloud provider data processing locations; document all sub-processor locations per service provider agreements
Consumer rights requests consistently exceed 45-day response deadlineManual fulfillment process without tracking system or unclear ownershipImplement ccpa_data_mapper.py to map PI across all systems; deploy request tracking with automated deadline alerts; assign per-system data stewards
GPC signal detection not workingApplication does not check Sec-GPC: 1 header or navigator.globalPrivacyControlImplement server-side header detection and client-side JavaScript check; test with browsers that support GPC (Firefox, Brave); log detection events
CPPA enforcement inquiry receivedPotential compliance gap discovered during regulatory sweep or consumer complaintImmediately run full compliance assessment; prioritize critical gaps (opt-out link, GPC, privacy policy); engage privacy counsel; document remediation timeline
Vendor contracts missing CCPA-required provisionsService provider agreements predate CPRA amendmentsAudit all vendor agreements against CCPA service provider/contractor requirements; update contracts to include certification, limited use, audit rights, and data deletion obligations
Risk assessment requirements unclearNew CPRA regulations (effective January 1, 2026) mandate risk assessments for six processing categoriesReview processing activities against the six "significant risk" categories; document risk assessments per CPPA regulatory template; plan for April 2028 attestation deadline

---

Success Criteria

  • Overall compliance score of 80+ on initial assessment -- indicating foundational CCPA/CPRA controls are in place, with per-category scores identifying targeted remediation areas
  • All consumer rights requests fulfilled within 45 calendar days -- with 10-business-day acknowledgment, tracked through a request management system with automated deadline alerts
  • Privacy policy updated at least annually -- with documented reviews quarterly, disclosing all 11 PI categories collected, sources, purposes, third-party sharing, and all seven consumer rights
  • GPC signal honored automatically -- detected via Sec-GPC: 1 header and navigator.globalPrivacyControl, applied to both sale and sharing of PI, with no re-authentication required
  • Complete data inventory maintained -- all PI categories mapped to collection sources, business purposes, sharing recipients, and retention schedules using ccpa_data_mapper.py
  • Service provider and contractor agreements include all CCPA-required provisions -- including certification of limited use, deletion obligations, audit rights, and sub-contractor chain documentation
  • Risk assessments completed for all applicable processing activities -- covering the six CPRA significant-risk categories, with attestation readiness by the April 2028 deadline

---

Scope & Limitations

In Scope:

  • CCPA/CPRA applicability determination (revenue, consumer count, PI revenue thresholds)
  • Privacy policy compliance assessment against all required disclosures
  • Consumer rights readiness validation (Know, Delete, Opt-Out, Correct, Portability, Limit SPI Use)
  • Data inventory mapping across all 11 CCPA personal information categories
  • Sensitive personal information identification per CPRA definitions
  • Technical safeguard assessment (encryption, access controls, opt-out mechanisms)
  • Service provider and contractor agreement requirements

Out of Scope:

  • Legal advice or determination of exemption applicability (HIPAA, GLBA, FCRA, employment data) -- consult privacy counsel for exemption analysis
  • Implementation of cookie consent management platforms or GPC signal handling code
  • CCPA private right of action defense (data breach litigation) -- consult legal counsel
  • Other state privacy laws (Virginia VCDPA, Colorado CPA, Connecticut CTDPA) beyond the comparison tables provided -- use jurisdiction-specific guidance
  • Automated decision-making technology (ADMT) compliance under CPRA regulations effective January 2027 -- monitor CPPA rulemaking for final requirements

Important Notes:

  • CPPA enforcement is escalating significantly in 2025-2026, with fines exceeding $1.3M in individual cases and joint multi-state enforcement sweeps targeting GPC non-compliance
  • New CPRA regulations effective January 1, 2026 add risk assessment, cybersecurity audit, and updated compliance requirements -- plan implementation accordingly

---

Integration Points

SkillIntegrationWhen to Use
gdpr-dsgvo-expertUnified privacy program satisfying both GDPR and CCPA; cross-framework privacy mappingWhen organization operates in both EU and California markets
infrastructure-compliance-auditorTechnical safeguard validation (encryption, access controls, logging) for CCPA reasonable securityWhen assessing infrastructure controls supporting CCPA compliance
information-security-manager-iso27001Security controls supporting CCPA "reasonable security" requirementWhen building security program that satisfies both ISO 27001 and CCPA
soc2-compliance-expertSOC 2 controls mapped to CCPA technical safeguard requirementsWhen SOC 2 audit evidence supports CCPA security compliance

---

Tool Reference

ccpa_compliance_checker.py

Evaluates organizational readiness against all CCPA/CPRA requirements across 8 assessment categories.

FlagRequiredDescription
--input <file>Yes (unless --template)Path to JSON company profile for assessment
--templateNoGenerate blank input template to stdout
--jsonNoOutput results in JSON format for automation
--output <file>NoExport report to specified file path

Output: Overall compliance score (0-100), per-category scores with pass/fail/partial status, prioritized findings with regulatory references, and remediation recommendations.

ccpa_data_mapper.py

Maps personal information categories, tracks data flows, and generates data inventory reports.

FlagRequiredDescription
--input <file>Yes (unless --template)Path to JSON data inventory for mapping
--templateNoGenerate blank inventory template to stdout
--output <file>NoExport mapping report to specified file path
--flow-diagramNoGenerate text-based data flow diagram showing collection, use, sharing, and selling paths

Output: PI category mapping across all 11 CCPA categories, SPI identification, data flow analysis (sources, purposes, recipients), cross-border transfer flags, and data retention gap detection.

Related skills

microsoftEntra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kmicrosoftAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3kxixu-meOpenclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72better-authBetter Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206firebaseFirebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397squirrelscanAudit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85

FAQ

How many PI categories does it map?

It maps all 11 CCPA personal information categories and identifies sensitive personal information per CPRA definitions.

What does the compliance checker output?

An overall compliance score from 0-100, per-category pass/fail/partial status, prioritized findings with regulatory references, and remediation recommendations.

Securitycomplianceaudit
Browse by category
AI & AgentsFrontend & DesignBackend & DataDev ToolsAutomationTesting & ReviewSecurityMonitoring & CloudDocs & Planning
Design & frontend
Design systemsAnimation & motionAccessibility (a11y)CSS & TailwindUI designUXDesign to codeshadcn/uiLanding pagesBest design skills
Most searched skills
find-skillscavemanfrontend-designbrainstormingsystematic-debuggingstop-slopemil-design-engui-ux-pro-maxkarpathy-guidelinesweb-design-guidelinesreact-best-practicesgrill-meimprovemicrosoft-foundryagent-browser
Browse all listings
All agent skillsAll MCP serversAll marketplacesAll plugins

This week in AI coding

Five minutes, every Monday - the tools, releases and tactics for developers.

unsubscribe anytime.