US Privacy Compliance for Australian Businesses.

If the CCPA applies to your business, here are the core obligations you must meet:

Right to know

California consumers have the right to request that you disclose what personal information you have collected about them, the sources of that information, the purposes for collection, and the third parties with whom you have shared it. You must respond to these requests within 45 days.

Right to delete

Consumers can request that you delete their personal information. You must comply and direct any service providers or third parties who received the data to delete it as well, subject to certain exceptions (e.g., completing a transaction, legal obligations, security purposes).

Right to opt out of sale or sharing

This is one of the CCPA's most distinctive requirements. If you "sell" or "share" personal information — which under the CCPA includes sharing data with third-party advertisers and analytics providers — you must provide a "Do Not Sell or Share My Personal Information" link on your website. "Sharing" includes cross-context behavioural advertising, which means that if you use retargeting ads or share data with ad networks, this requirement likely applies.

Right to correct

Added by the CPRA, consumers can request that you correct inaccurate personal information. You must use commercially reasonable efforts to correct the information within 45 days.

Right to limit use of sensitive personal information

Also added by the CPRA, consumers can direct you to limit the use of sensitive personal information (such as precise geolocation, racial or ethnic origin, religious beliefs, health information, and financial account details) to only what is necessary for the services they requested.

Privacy policy disclosures

Your privacy policy must include specific CCPA-required disclosures: categories of personal information collected, purposes for collection, categories of third parties receiving data, consumer rights under the CCPA, and how to submit requests. This goes well beyond what the Australian Privacy Act requires.

CCPA enforcement is real, and the penalties are significant:

• Civil penalties: The California Attorney General and CalPrivacy can impose fines of up to US$2,500 per unintentional violation and US$7,500 per intentional violation. These are assessed per violation, per consumer — meaning a single non-compliant practice affecting thousands of California users can result in millions of dollars in fines.
• Private lawsuits (data breaches): The CCPA provides a private right of action for data breaches resulting from a business's failure to maintain reasonable security measures. Consumers can sue for statutory damages of US$100–750 per consumer per incident. A breach affecting 10,000 California users could mean exposure of US$1M–7.5M in statutory damages alone.
• Enforcement actions: CalPrivacy has been actively investigating and enforcing since 2023. Recent enforcement actions have targeted companies of all sizes, including those outside the US. The agency has signalled that foreign companies are not exempt from enforcement.

Beyond financial penalties, non-compliance creates reputational risk. California consumers are increasingly privacy-aware, and a publicised enforcement action can damage trust with your US customer base.

Generally speaking, a non-healthcare business is only required to comply with HIPAA when it handles 'protected health information' on behalf of a 'covered entity'.

A 'covered entity' is:

• health care providers that transmit information in electronic form (doctors, clinics, psychologists, dentists, etc.);
• health plan providers (health insurance companies, company health plans, Medicaid/Medicare); and
• health care clearinghouses.

If you are handling protected health information on behalf of any of the above, then you are a 'business associate' and must do the following:

• sign and comply with a Business Associate Agreement with the covered entity (that complies with HIPAA rules);
• comply with the 'Security Rule', which means that you need to:
  • appoint a security officer to oversee compliance;
  • perform and document a risk assessment;
  • implement administrative, physical and technical safeguards of protected health information;
  • have Business Associate Agreements in place with any subcontractors who will have access to protected health information;
  • maintain written policies and procedures in relation to security compliance; and
  • provide on-going training to your personnel on HIPAA compliance.
• must only deal with the minimum amount of protected health information necessary to perform your obligations; and
• report breaches of protected health information.

We can assist in preparing a Business Associate Agreement for covered entities to accept when working with you, and for your contractors/subprocessors to accept when working for you, along with a security and breach policy. There are also online HIPAA compliance providers that you might find helpful, particularly in respect of workforce training or data safeguards compliance (which are operational matters we cannot assist with).