FAQ: California Consumer Privacy Act (CCPA)

What is CCPA?

• It’s the California Consumer Privacy Act (CCPA).
• CCPA was enacted on June 28, 2018 and becomes effective on January 1, 2020.
• CCPA grants consumers new rights regarding their personal information.
• It sets out the responsibilities of businesses in relation to:
  1. the transparency under which they must operate regarding personal information; and
  2. the rights they must give to California consumers and households regarding their personal information.
• For more information, be sure to visit Sage's CCPA page at https://sage.com/ccpa.

Does the CCPA apply to my company/organization?

It applies to for-profit companies, doing business in California, that collect California consumers’ personal information, or companies that have such information on their behalf must comply with the CCPA, if they meet any of the following thresholds:

• Annual gross revenues more than $25 million
• Annually buys, receives for its commercial purposes, sells, or shares for commercial purposes personal information relating to 50,000 or more consumers, households, or devices
• Derives 50% or more of its annual revenue from selling consumers’ personal information.

Is Sage 50 US CCPA-ready?

Yes, Sage 50 US is CCPA-ready.

Do I need to disclose the consumer’s rights in relation to their personal information?

• You collect and enter data in Sage 50 US. It is your company’s responsibility to disclose this to your customers and vendors.
• Sage 50 US doesn’t permit your customers to enter their personal data in the program.(for example, via a web interface).
• It is your company’s responsibility to disclose your customer’s rights in relation to their personal information you’re collecting.

Does Sage 50 US help me not to share personal information of anyone under 16 years of age unless the consumer has expressly opted in?

• Sage 50 US doesn’t permit consumers to enter data themselves (for example, via a web interface).
• Your company will need to retain evidence of any opt-in consent to share the minor’s personal information outside of Sage 50 US.

Does Sage 50 US help me not to request opt-in for personal information sharing consent more frequently than once every 12 months?

• Sage 50 US doesn’t permit consumers to enter data themselves (for example, via a web interface).
• Your company will need to manage opt-in requests outside of Sage 50 US.

If a consumer asks to disclose the request history, how do I get the information from Sage 50 US?

Your company will need to manage disclosure requests outside of Sage 50 US.

How do I provide my customers a “don’t sell my personal information” capability?

• Sage 50 US doesn’t permit consumers to enter data themselves (for example, via a web interface).
• Your company will have to manage this requirement themselves.

How do I provide at least two methods for consumers to submit a request for disclosure of personal information?

Your company will need to decide on what methods they’ll provide their customers to submit a request for disclosure.

How do I verify the consumer’s identity?

• Sage 50 US doesn’t permit consumers to enter data themselves (for example, via a web interface).
• Business will have to manage this requirement themselves.

How do I track the format of disclosure required by consumers?

Your company is responsible for tracking the format of disclosure required by consumers.

How do I classify personal information according to category and purpose?

Your company is responsible for disclosing the categories and purpose of personal information that you collect from your customers.

How do I create a disclosure report of stored personal information?

Refer to Article ID 101631: How do I create a disclosure report of stored personal information?.

How do I create a disclosure report of sold personal information?

• Your company is responsible for creating a disclosure report of sold personal information.
• Sage 50 US doesn’t track when your company sells consumers’ personal information.

Does Sage 50 US ensure that any disclosure reports can be saved as electronic files?

• No, Sage 50 does have disclosure reports.
• Your company is responsible for creating a disclosure report of sold personal information.
• Sage 50 US doesn’t know what personal information is sold.

How do I delete personal information if requested to do so and I have no valid reason to retain it?

• Sage 50 US allows you to delete data that contains personal information.
• Refer to Article ID 101632: How do I delete personal information if requested to do so and I have no valid reason to retain it?.

How do I avoid discrimination against consumers?

• Your company is responsible for avoiding discrimination against consumers.
• Sage 50 doesn’t (and won’t) contain features solely for enabling any listed form of discrimination against Californian consumers.

How do I respond to disclosure requests within 45 days?

• Disclosure requests won’t be tracked inside Sage 50 US.
• Your company is responsible for responding to disclosure requests within the allotted time.

Can Sage 50 US help me provide disclosures free of charge?

It’s up to your company to provide disclosures free of charge.