Broader than it first appears, because it applies to businesses over certain thresholds regardless of where they are based, if they handle data on California residents. In practice it pushes the same architectural question as GDPR: can you find, export and delete everything you hold about one person.
More in Privacy
- AnonymizationIrreversibly stripping data of anything that could identify a person. Unlike pseudonymization, there is no key that brings the identity back.
- Consent managementRecording what each user agreed to and enforcing it at collection, so consent is a property of the pipeline rather than a banner.
- Data minimizationCollecting only what a stated purpose needs. The cheapest way to reduce risk is not to hold the data at all.
- Data residencyThe requirement that data physically stays in a given jurisdiction. On Flex you pick the region; on Enterprise it is wherever you deploy.
- Data sovereigntyThe principle that data is subject to the laws of the country it sits in, and that you, not a vendor, decide which country that is.
- GDPREU regulation governing personal data, covering the lawful basis for collection, rights to access and erasure, and real consequences for ignoring both.