Personnel handling requests trained on CCPA/CPRA requirements

CCPA § 1798.130(a)(6) requires that all individuals responsible for handling consumer privacy inquiries are informed of CCPA requirements and trained on how to direct consumers to exercise their rights. Without a designated privacy contact and a documented fulfillment process, consumer requests that arrive via the privacy form have no guaranteed path to a response — the 45-day statutory deadline starts running the moment a request is received, regardless of whether anyone is monitoring the inbox. In a two-person startup, "training" can be a one-page runbook; regulators accept that. What they do not accept is an unmonitored inbox or no documented process at all.

Create a PRIVACY_OPERATIONS.md file that designates a privacy contact, documents the response timeline, and provides step-by-step fulfillment instructions for each request type. Route privacy request emails to a monitored inbox.

# PRIVACY_OPERATIONS.md

## CCPA Consumer Request Handling

**Designated Privacy Contact:** [Name / Role]
**Request Inbox:** privacy@example.com (monitored daily)

### Response Timeline (CCPA § 1798.130)
- Acknowledge within 10 business days
- Fulfill within 45 calendar days (extendable to 90 with consumer notice)
- Opt-out requests: effective immediately; third-party notification within 15 business days

### Right to Know — Fulfillment Steps
1. Verify identity via email confirmation link
2. Query: SELECT * FROM users WHERE email = $email; pull all associated records
3. Compile report covering CCPA PI categories
4. Email report to verified consumer address within 45 days

### Right to Delete — Fulfillment Steps
1. Verify identity
2. Apply CCPA exceptions (active transaction, fraud prevention, legal hold)
3. Permanently delete from primary DB; notify service providers of deletion
4. Send deletion confirmation to consumer

For teams larger than one person, add a quarterly calendar reminder to review the runbook for CCPA regulatory updates.