Compliance Program Charter - California

COMPLIANCE PROGRAM CHARTER — CALIFORNIA SUPPLEMENT

Company: [________________________________]
Effective Date: [__/__/____]
Approved by: [________________________________]
Version: [____]

TABLE OF CONTENTS

1. Purpose and Authorization
2. California Regulatory Landscape
3. Scope — California-Specific Compliance Domains
4. Governance Enhancements
5. Core Program Elements — California Focus
6. California Regulatory Change Management
7. California-Specific Reporting and Metrics
8. Resources
9. Review and Approval
10. Annexes

1. PURPOSE AND AUTHORIZATION

This supplement to the Universal Compliance Program Charter addresses California-specific regulatory requirements. California maintains one of the most comprehensive and actively enforced regulatory regimes in the United States, including the CCPA/CPRA (nation's strongest comprehensive privacy law), FEHA (broader employment protections than federal law), the Unfair Competition Law (UCL), and the Consumer Legal Remedies Act (CLRA). The California Privacy Protection Agency (CPPA) has rulemaking authority and enforcement powers under the CPRA.

2. CALIFORNIA REGULATORY LANDSCAPE

3. SCOPE — CALIFORNIA-SPECIFIC COMPLIANCE DOMAINS

In addition to the universal compliance domains, the following California-specific areas require dedicated program attention:

3.1 Privacy and Data Security

☐ CCPA/CPRA compliance: privacy notices, consumer rights (Know, Delete, Correct, Portability, Opt-Out of Sale/Sharing, Limit Sensitive PI), service provider/contractor agreements, GPC recognition
☐ CPPA regulations implementation: current risk-assessment duties and cybersecurity-audit schedule; ADMT readiness for the January 1, 2027 compliance date
☐ California breach notification (Cal. Civ. Code § 1798.82): qualifying resident notice within 30 calendar days of discovery or notification, subject to statutory delays; redacted sample to AG within 15 calendar days after resident notice if notice is required for more than 500 California residents from one breach

3.2 Consumer Protection

☐ UCL (§ 17200): unfair, unlawful, or fraudulent business acts — review marketing, pricing, disclosures
☐ CLRA (Civ. Code § 1750): consumer goods/services representations — review advertising and sales practices
☐ False Advertising Law (§ 17500): truthfulness of advertising claims

3.3 Employment

☐ FEHA (Gov. Code §§ 12926(d), 12940(j)(4)(A)): check discrimination and retaliation duties under the general five-employee definition; harassment duties also cover an employer regularly employing one or more people or regularly receiving one or more contract workers' services.
☐ Wage/hour: California-specific meal/rest period requirements, overtime, paid sick leave, pay transparency (SB 1162)
☐ Whistleblower protections (Lab. Code § 1102.5): protections against retaliation for reporting violations of law
☐ Mandatory sexual harassment prevention training (Gov. Code § 12950.1)

3.4 AI and Technology

☐ ADMT regulations (11 CCR §§ 7200–7222): prepare pre-use notice, access, opt-out, and applicable appeal procedures for covered significant decisions by January 1, 2027
☐ Monitor evolving California AI legislation and CPPA rulemaking

4. GOVERNANCE ENHANCEMENTS

4.1 California Compliance Oversight

4.2 CPPA Regulatory Engagement

☐ Designate point of contact for CPPA inquiries and investigations
☐ Monitor CPPA rulemaking proceedings and public comment periods
☐ Track CPPA enforcement actions and apply lessons learned
☐ Maintain records to support CPPA audit/investigation response

5. CORE PROGRAM ELEMENTS — CALIFORNIA FOCUS

5.1 Risk Assessment — CA Additions

5.2 Policies — CA-Specific

☐ California Privacy Notice (CPRA-compliant)
☐ Service Provider/Contractor Agreement template (CPRA-compliant)
☐ Consumer Rights Request procedures
☐ California breach notification procedures
☐ FEHA anti-harassment/anti-discrimination policy (CA-specific provisions)
☐ California wage/hour compliance guide
☐ Whistleblower protection policy (Lab. Code § 1102.5)
☐ ADMT transparency policy (when applicable)

5.3 Training — CA-Specific

5.4 Monitoring and Testing — CA Additions

☐ CCPA/CPRA consumer rights request handling — sample testing of response times and accuracy
☐ GPC signal recognition verification
☐ Service provider/contractor agreement audit for CPRA compliance
☐ Marketing review for UCL/CLRA compliance
☐ FEHA training completion tracking
☐ Review pay practices for equity (internal practice); check applicable pay-scale disclosures and pay-data reporting separately
☐ Breach notification tabletop exercise

5.5 Third-Party Risk — CA Additions

☐ CPRA service provider/contractor classification for all CA-data vendors
☐ GPC/opt-out signal compliance verification
☐ Subcontractor flow-down verification
☐ Exercise reasonable and appropriate step rights under § 1798.100(d)(3); document separate authority and contract terms for any audit mechanism

6. CALIFORNIA REGULATORY CHANGE MANAGEMENT

7. CALIFORNIA-SPECIFIC REPORTING AND METRICS

Report California-specific metrics to [Board/Committee] quarterly.

8. RESOURCES

Ensure adequate resources for California-specific compliance, including:

☐ Privacy team staffing for CCPA/CPRA program
☐ Employment counsel for FEHA/wage-hour
☐ Consumer protection review resources
☐ External CA regulatory counsel
☐ Training platform supporting CA-specific content

9. REVIEW AND APPROVAL

Review this supplement annually or upon material California regulatory change. Approval recorded in Board/Committee minutes.

10. ANNEXES

Annex A: California Regulatory Calendar

Annex B: CCPA/CPRA Compliance Program Checklist

☐ Privacy notice published and current (Cal. Civ. Code § 1798.100(a))
☐ Consumer rights request intake mechanisms operational (online, toll-free, email)
☐ Processes verified for all CPRA consumer rights:

• Right to Know / Access (§§ 1798.110, 1798.115)
• Right to Delete (§ 1798.105)
• Right to Correct (§ 1798.106)
• Data-portability support through delivery in a readily usable, transferable format (§ 1798.130(a)(2)(A))
• Right to Opt-Out of Sale/Sharing (§ 1798.120)
• Right to Limit Use of Sensitive PI (§ 1798.121)
• Right to Non-Discrimination (§ 1798.125)
  ☐ Respond to know/delete/correct requests within 45 calendar days (up to 45 more with notice and explanation under 11 CCR § 7021); honor opt-out/limit requests as soon as feasible, no later than 15 business days (11 CCR §§ 7026(f), 7027(g))
  ☐ GPC / universal opt-out signal recognized (§ 1798.135; 11 CCR § 7025)
  ☐ Where required, provide a clear "Do Not Sell or Share My Personal Information" link on the internet homepage, or a qualifying combined link; assess the opt-out preference-signal exception (§ 1798.135(a)-(b))
  ☐ Where required, provide a clear "Limit the Use of My Sensitive Personal Information" homepage link, or a qualifying combined link; assess the opt-out preference-signal exception (§ 1798.135(a)-(b))
  ☐ Service provider agreements with CPRA-compliant terms (§ 1798.100(d))
  ☐ Contractor agreements with certification and audit terms (§ 1798.140(j))
  ☐ Subcontractor flow-down verified under the identified contract, definition, or regulation: [________________________________] (§ 1798.100(d)(5) concerns stop-and-remediate rights, not flow-down)
  ☐ Data inventory/mapping current
  ☐ Retention schedules limited to what is reasonably necessary (§ 1798.100(a)(3))
  ☐ Risk assessments before processing that meets 11 CCR § 7150's significant-risk criteria (Cal. Civ. Code § 1798.185(a)(14)(B))
  ☐ ADMT notice, access, and opt-out readiness for January 1, 2027 (11 CCR §§ 7200–7222, if applicable)

Annex C: FEHA Employment Compliance Checklist

☐ Written anti-harassment policy adopted and distributed (2 Cal. Code Regs. § 11023)
☐ Complaint procedures clearly communicated to all employees
☐ Sexual harassment prevention training completed:

• Supervisors: 2 hours (Gov. Code § 12950.1(a))
• Non-supervisory employees: 1 hour (Gov. Code § 12950.1(a)(1))
  ☐ Training records maintained
  ☐ Accommodation interactive process documented
  ☐ Pay practices reviewed for equity (internal practice); applicable pay-scale disclosures and pay-data reporting checked separately
  ☐ Pay ranges disclosed in job postings (Lab. Code § 432.3)
  ☐ Pregnancy/lactation accommodations policy in place
  ☐ Leave policies comply with CFRA, PDL, and other CA leave laws

SOURCES AND REFERENCES

• CCPA/CPRA, Cal. Civ. Code § 1798.100 et seq.
• CPPA Regulations, 11 CCR § 7000 et seq.
• Cal. Civ. Code § 1798.82 (Breach Notification)
• Cal. Bus. & Prof. Code § 17200 (Unfair Competition Law)
• Cal. Civ. Code § 1750 (Consumer Legal Remedies Act)
• Cal. Gov. Code § 12940 (FEHA)
• Cal. Gov. Code § 12950.1 (Harassment Training)
• Cal. Lab. Code § 1102.5 (Whistleblower Protections)
• DOJ Evaluation of Corporate Compliance Programs (Updated September 2024)
• U.S. Sentencing Guidelines § 8B2.1

This template is provided for informational purposes only and does not constitute legal advice. Consult qualified legal counsel before use.