Topic starter
23/10/2026 12:47 am
TL;DR: California SB 923 widens deletion duties and requires online-only businesses to offer an online request method, while also extending deletion scope and tightening compliance timelines, according to Osano. DSAR handling now has to cover identity checks, downstream systems, and proof of completion, not just intake.
Editorial analysis by NHI Mgmt Group, based on content published by Osano: “SB 923 and CCPA Webforms: How Subject Rights in California Just Changed”.
Key questions
Q: Why do subject rights workflows need identity verification rules?
A: Because different request types create different risk levels, and some laws restrict verification for simple opt-outs.
Q: How can organisations prove deletion actually reached all systems?
A: They need data mapping, owner assignment, and completion logging across internal platforms and vendors.
Q: What breaks when DSAR requests are handled with a CMS form?
A: A CMS form often routes requests into marketing or CRM workflows first, which can create new contact records, miss non-CMS data stores, and weaken deletion evidence.
Practitioner guidance
- Implement a dedicated DSAR workflow Separate privacy requests from marketing forms, CRM contact creation, and support tickets so a deletion request cannot recreate the requester as a new contact.
- Map every downstream data store Inventory internal systems, vendors, brokers, and inferred-data stores that can repopulate consumer records, then attach deletion handling to each owner.
- Policy-enable request verification Apply different verification rules by request type, and disable unnecessary verification where the law bars it for simple opt-outs.
Bottom line: California SB 923 widens deletion obligations and makes online request handling mandatory for certain online-only businesses, which raises the operational burden on privacy programmes.
Glossary terms: Subject Rights Request, Deletion Propagation, Identity Verification For Privacy Requests, Suppression Record
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
SB 923 turns subject rights handling into a governance workflow, not a form project. The article shows that the compliance failure mode is treating privacy requests as a front-end task while the data lives across CRM, warehouse, support, and vendor systems. That creates a lifecycle gap where intake, verification, execution, and evidence are no longer controlled as one process. Practitioners should treat DSAR operations as a governed workflow spanning identity, records, and data handling.
A question worth separating out:
Q: What is the difference between a privacy request form and DSAR management?
A: A form only collects a request. DSAR management governs intake, verification, routing, execution, deadlines, suppression handling, and evidence retention. The difference is operational control. A form can submit work, but DSAR management proves that the work was completed correctly and consistently across systems.
👉 Read our full editorial: California SB 923 raises the bar for DSAR workflows
This post was modified 6 days ago by NHI Mgmt Group