California SB 923: are your DSAR controls keeping up?

TL;DR: California SB 923 expands CCPA deletion rights and requires online-only businesses to offer an online request method, while also extending deletion scope to data collected from or about a consumer and tightening compliance timelines, according to Osano. The practical shift is that DSAR handling becomes a governed workflow across systems, not a form on a privacy page.

Editorial analysis by NHI Mgmt Group, based on content published by Osano: “SB 923 and CCPA Webforms: How Subject Rights in California Just Changed”.

Key questions

Q: What breaks when DSAR requests are handled with a CMS form?

A: A CMS form often routes requests into marketing or CRM workflows first, which can create new contact records, miss non-CMS data stores, and weaken deletion evidence.

Q: Why do subject rights workflows need identity verification rules?

A: Because different request types create different risk levels, and some laws restrict verification for simple opt-outs.

Q: How can organisations prove deletion actually reached all systems?

A: They need data mapping, owner assignment, and completion logging across internal platforms and vendors.

Practitioner guidance

• Implement a dedicated DSAR workflow Separate privacy requests from marketing forms, CRM contact creation, and support tickets so a deletion request cannot recreate the requester as a new contact.
• Map every downstream data store Inventory internal systems, vendors, brokers, and inferred-data stores that can repopulate consumer records, then attach deletion handling to each owner.
• Policy-enable request verification Apply different verification rules by request type, and disable unnecessary verification where the law bars it for simple opt-outs.

Bottom line: California SB 923 widens deletion obligations and makes online request handling mandatory for certain online-only businesses, which raises the operational burden on privacy programmes.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →