Compliance Program Charter - California

COMPLIANCE PROGRAM CHARTER — CALIFORNIA SUPPLEMENT

Company: [________________________________]
Effective Date: [__/__/____]
Approved by: [________________________________]
Version: [____]

TABLE OF CONTENTS

1. Purpose and Authorization
2. California Regulatory Landscape
3. Scope — California-Specific Compliance Domains
4. Governance Enhancements
5. Core Program Elements — California Focus
6. California Regulatory Change Management
7. California-Specific Reporting and Metrics
8. Resources
9. Review and Approval
10. Annexes

1. PURPOSE AND AUTHORIZATION

This supplement to the Universal Compliance Program Charter addresses California-specific regulatory requirements. California maintains one of the most comprehensive and actively enforced regulatory regimes in the United States, including the CCPA/CPRA (nation's strongest comprehensive privacy law), FEHA (broader employment protections than federal law), the Unfair Competition Law (UCL), and the Consumer Legal Remedies Act (CLRA). The California Privacy Protection Agency (CPPA) has rulemaking authority and enforcement powers under the CPRA.

2. CALIFORNIA REGULATORY LANDSCAPE

3. SCOPE — CALIFORNIA-SPECIFIC COMPLIANCE DOMAINS

In addition to the universal compliance domains, the following California-specific areas require dedicated program attention:

3.1 Privacy and Data Security

☐ CCPA/CPRA compliance: privacy notices, consumer rights (Know, Delete, Correct, Portability, Opt-Out of Sale/Sharing, Limit Sensitive PI), service provider/contractor agreements, GPC recognition
☐ CPPA regulations implementation: current risk-assessment duties and cybersecurity-audit schedule; ADMT readiness for the January 1, 2027 compliance date
☐ California breach notification (Cal. Civ. Code § 1798.82): expedient notification; AG notice for >500 CA residents

3.2 Consumer Protection

☐ UCL (§ 17200): unfair, unlawful, or fraudulent business acts — review marketing, pricing, disclosures
☐ CLRA (Civ. Code § 1750): consumer goods/services representations — review advertising and sales practices
☐ False Advertising Law (§ 17500): truthfulness of advertising claims

3.3 Employment

☐ FEHA (Gov. Code § 12940): harassment, discrimination, retaliation protections broader than federal Title VII (includes all employers with 5+ employees)
☐ Wage/hour: California-specific meal/rest period requirements, overtime, paid sick leave, pay transparency (SB 1162)
☐ Whistleblower protections (Lab. Code § 1102.5): protections against retaliation for reporting violations of law
☐ Mandatory sexual harassment prevention training (Gov. Code § 12950.1)

3.4 AI and Technology

☐ ADMT regulations (11 CCR § 7030): prepare transparency, access, opt-out, and appeal procedures for covered uses by January 1, 2027
☐ Monitor evolving California AI legislation and CPPA rulemaking

4. GOVERNANCE ENHANCEMENTS

4.1 California Compliance Oversight

4.2 CPPA Regulatory Engagement

☐ Designate point of contact for CPPA inquiries and investigations
☐ Monitor CPPA rulemaking proceedings and public comment periods
☐ Track CPPA enforcement actions and apply lessons learned
☐ Maintain records to support CPPA audit/investigation response

5. CORE PROGRAM ELEMENTS — CALIFORNIA FOCUS

5.1 Risk Assessment — CA Additions

5.2 Policies — CA-Specific

☐ California Privacy Notice (CPRA-compliant)
☐ Service Provider/Contractor Agreement template (CPRA-compliant)
☐ Consumer Rights Request procedures
☐ California breach notification procedures
☐ FEHA anti-harassment/anti-discrimination policy (CA-specific provisions)
☐ California wage/hour compliance guide
☐ Whistleblower protection policy (Lab. Code § 1102.5)
☐ ADMT transparency policy (when applicable)

5.3 Training — CA-Specific

5.4 Monitoring and Testing — CA Additions

☐ CCPA/CPRA consumer rights request handling — sample testing of response times and accuracy
☐ GPC signal recognition verification
☐ Service provider/contractor agreement audit for CPRA compliance
☐ Marketing review for UCL/CLRA compliance
☐ FEHA training completion tracking
☐ Pay equity analysis (SB 1162)
☐ Breach notification tabletop exercise

5.5 Third-Party Risk — CA Additions

☐ CPRA service provider/contractor classification for all CA-data vendors
☐ GPC/opt-out signal compliance verification
☐ Subcontractor flow-down verification
☐ Exercise reasonable and appropriate step rights under § 1798.100(d)(3); document separate authority and contract terms for any audit mechanism

6. CALIFORNIA REGULATORY CHANGE MANAGEMENT

7. CALIFORNIA-SPECIFIC REPORTING AND METRICS

Report California-specific metrics to [Board/Committee] quarterly.

8. RESOURCES

Ensure adequate resources for California-specific compliance, including:

☐ Privacy team staffing for CCPA/CPRA program
☐ Employment counsel for FEHA/wage-hour
☐ Consumer protection review resources
☐ External CA regulatory counsel
☐ Training platform supporting CA-specific content

9. REVIEW AND APPROVAL

Review this supplement annually or upon material California regulatory change. Approval recorded in Board/Committee minutes.

10. ANNEXES

Annex A: California Regulatory Calendar

Annex B: CCPA/CPRA Compliance Program Checklist

☐ Privacy notice published and current (Cal. Civ. Code § 1798.100(a))
☐ Consumer rights request intake mechanisms operational (online, toll-free, email)
☐ Processes verified for all CPRA consumer rights:

• Right to Know / Access (§ 1798.100)
• Right to Delete (§ 1798.105)
• Right to Correct (§ 1798.106)
• Data-portability support (current authority/procedure: [________________________________])
• Right to Opt-Out of Sale/Sharing (§ 1798.120)
• Right to Limit Use of Sensitive PI (§ 1798.121)
• Right to Non-Discrimination (§ 1798.125)
  ☐ Response timeline: 45 days (extendable by 45 days per 11 CCR § 7024)
  ☐ GPC / universal opt-out signal recognized (§ 1798.135; 11 CCR § 7025)
  ☐ "Do Not Sell or Share" link in website footer (§ 1798.135(a))
  ☐ "Limit the Use of My Sensitive PI" link (if sensitive PI processed) (§ 1798.135(a))
  ☐ Service provider agreements with CPRA-compliant terms (§ 1798.100(d))
  ☐ Contractor agreements with certification and audit terms (§ 1798.140(j))
  ☐ Subcontractor flow-down verified under the identified contract, definition, or regulation: [________________________________] (§ 1798.100(d)(5) concerns stop-and-remediate rights, not flow-down)
  ☐ Data inventory/mapping current
  ☐ Retention schedules limited to what is reasonably necessary (§ 1798.100(a)(3))
  ☐ Risk assessments for significant processing (§ 1798.185(a)(15))
  ☐ ADMT transparency and opt-out readiness for January 1, 2027 (11 CCR § 7030, if applicable)

Annex C: FEHA Employment Compliance Checklist

☐ Anti-harassment policy adopted (compliant with Gov. Code § 12950)
☐ Complaint procedures clearly communicated to all employees
☐ Sexual harassment prevention training completed:

• Supervisors: 2 hours (Gov. Code § 12950.1(a))
• Non-supervisory employees: 1 hour (Gov. Code § 12950.1(b))
  ☐ Training records maintained
  ☐ Accommodation interactive process documented
  ☐ Pay equity analysis conducted (Lab. Code § 1197.5; SB 1162)
  ☐ Pay ranges disclosed in job postings (Lab. Code § 432.3)
  ☐ Pregnancy/lactation accommodations policy in place
  ☐ Leave policies comply with CFRA, PDL, and other CA leave laws

SOURCES AND REFERENCES

• CCPA/CPRA, Cal. Civ. Code § 1798.100 et seq.
• CPPA Regulations, 11 CCR § 7050 et seq.
• Cal. Civ. Code § 1798.82 (Breach Notification)
• Cal. Bus. & Prof. Code § 17200 (Unfair Competition Law)
• Cal. Civ. Code § 1750 (Consumer Legal Remedies Act)
• Cal. Gov. Code § 12940 (FEHA)
• Cal. Gov. Code § 12950.1 (Harassment Training)
• Cal. Lab. Code § 1102.5 (Whistleblower Protections)
• DOJ Evaluation of Corporate Compliance Programs (Updated September 2024)
• U.S. Sentencing Guidelines § 8B2.1

This template is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel before use.