Is Your DROP Deletion Workflow Live by Aug 1?

Today's Focus: Privacy & Data Protection

California data brokers must process DROP deletions from 1 August

In four days, California's Delete Act reaches its operative milestone: from 1 August 2026, every business registered as a California data broker must begin processing consumer deletion requests through the state's centralized Delete Request and Opt-out Platform (DROP), run by the California Privacy Protection Agency and live to consumers since 1 January 2026. Brokers must access DROP at least once every 45 days, match and delete the requested personal information — including inferences and derived profiles — within 90 days, and report each request's status within 45 days. Failure to process carries a $200-per-day fine per deletion request, plus the Agency's investigation and administrative costs (Cal. Civ. Code § 1798.99.80 et seq.). A single consumer request routes to all 600+ registered brokers. CalPrivacy — DROP for data brokers

California opens first sectoral privacy audit — gig platforms. On 21 July, CalPrivacy's Audits Division launched its first formal sectoral audit under Cal. Civ. Code § 1798.199.40, testing whether ride-hail, delivery and task platforms honor the CCPA right to access within the 45-day window — for consumers and for the independent-contractor workers California uniquely covers. Map your algorithmic-decision data (dispatch, ratings, earnings, deactivation) to access-request outputs now. CalPrivacy source

EDPB draft breach-notification template — consultation closes 5 August. The EDPB's public consultation on a draft Article 33 personal-data-breach notification template closes in eight days. Review the draft against your current breach-notification workflow and file comments if your processes are affected. EDPB news

EU signals data-protection / competition convergence. On 23 July the EDPB and European Commission set a 15 October remote stakeholder event on forthcoming guidelines on the interplay between data protection and competition law; a call for expressions of interest opens in the coming weeks. Early signal, not yet binding — but worth watching if data-driven market power is part of your risk picture. EDPB save-the-date

If you are a registered California data broker, confirm your DROP account is approved and your match-delete-report workflow is live and tested before 1 August — the $200-per-day-per-request clock starts then.

AI governance — the week's AI regulation and governance developments.

CyberEyeQ — Actionable Regulatory Intelligence. Questions? [email protected]