529-41-7730 → [SSN_6c1]The same customer always gets the same token, so the model can still follow the ticket.
billing tool ← cardA tool or role gets the real value its task needs, and the release is logged.
precise location → not sentData the task does not need stays out of the AI flow (Civ. Code 1798.100(c)).
A specific purpose. The rules reject generic wording such as "to improve our services."
With ProtectoOne flow per purpose, each with its own policy, so the purpose you write matches what runs.
The categories processed, including sensitive ones, and the minimum the purpose needs.
With ProtectoThe model gets tokens in place of names, card numbers and health details. Fields the task does not need are held back.
How you collect, use, disclose and keep the data, and where it comes from.
With ProtectoOne checkpoint to describe: each source, each recipient, and what each one receives.
The harms to consumers, starting with unauthorized access or disclosure.
With ProtectoA leaked vendor log or vector index holds tokens. The mapping stays apart from the model provider.
The rules give examples: encryption, segmentation, access controls and privacy-enhancing technologies.
With ProtectoMasking before the model, unmasking by role and a policy per recipient, with logs that show them working.
Update within 45 calendar days of a material change, and review at least every three years.
With ProtectoWhen a team adds an agent or a data source, the logs show what changed in what the model receives.
Regulations in effect. Assess new sensitive-data processing before it starts.
11 CCR 7150, 7155(a)Rules for automated decisionmaking in significant decisions apply.
11 CCR 7200(b)Deadline to assess processing that was already running before 2026.
11 CCR 7155(b)First risk assessment submission, attested by an executive. First audit reports for the largest businesses.
11 CCR 7157, 7121| Rule | Requirement | Protecto solution |
|---|---|---|
| Purpose and minimum dataCiv. Code 1798.100(c) | Collection, use, retention and sharing of personal information must be reasonably necessary and proportionate to the purpose it was collected for. | Each AI flow gets only the fields its task needs. The model reads tokens in place of names, card numbers and health details. |
| Reasonable securityCiv. Code 1798.100(e) Civ. Code 1798.150 | Keep reasonable security appropriate to the data. A breach of nonencrypted and nonredacted personal information can bring statutory damages of $107 to $799 per consumer per incident. | Model inputs, vector stores and logs hold tokens. If one of them leaks, it does not hold the real card numbers or Social Security numbers. |
| Right to limit sensitive dataCiv. Code 1798.121 11 CCR 7027 | Consumers can limit the use of sensitive personal information. Stop other uses within 15 business days and tell every service provider using it to do the same. | Sensitive fields are tokenized by default, so fewer systems and vendors hold real values when a request to limit arrives. |
| Service providersCiv. Code 1798.100(d), 1798.140(ag) 11 CCR 7050 | A written contract limits each service provider to the business purposes it names, and lets you stop and fix unauthorized use. | Model providers receive tokens. The contract still matters, and far less real customer data sits under it. |
| Risk assessment11 CCR 7150, 7152 7155, 7157 | Assess processing of sensitive personal information before it starts. Document the minimum data needed and the safeguards. An executive attests to the submission. | Masking before the model, unmasking by role and per-recipient policy are safeguards you can name. Protecto's logs show them running. |
| Automated decisionmaking11 CCR 7200 7220 to 7222 | From January 1, 2027, technology that makes significant decisions needs a pre-use notice, an opt-out or human appeal, and access rights. | Protecto makes no decisions. Where AI supports a significant decision, Protecto's logs show which personal data reached the model and what was masked. |
| Cybersecurity audit11 CCR 7120 to 7124 | Businesses above the thresholds complete an annual independent audit that covers controls such as encryption and access controls. First reports are due from April 1, 2028. | Tokenization, role-based unmasking and logs give auditors controls to test on the AI data path. |
This page summarizes California law and regulations. It is not legal advice.
Yes, whenever an AI system processes personal information about California residents. The statute says personal information can exist in AI systems that are capable of outputting it (Civ. Code 1798.140(v)(4)(C)). The usual duties on purpose, minimization and security apply to that data too.
Before processing that presents significant risk starts. The regulations list processing sensitive personal information, selling or sharing personal information, and using automated decisionmaking technology for a significant decision, among others (11 CCR 7150(b)). Processing that began before January 1, 2026 and continues must be assessed by December 31, 2027 (7155(b)).
Social Security, driver's license, state ID and passport numbers; account log-ins and card or account numbers with the code that unlocks them; precise geolocation; racial or ethnic origin, citizenship, religion and union membership; the contents of mail, email and texts; genetic, neural and biometric data; and health, sex life and sexual orientation data (Civ. Code 1798.140(ae)).
Not by default. Under the CCPA, "sharing" means disclosing personal information to a third party for cross-context behavioral advertising (1798.140(ah)). A provider that processes data for you under a written contract is usually a service provider, which comes with its own contract and use limits (1798.140(ag), 11 CCR 7050). How a given provider's terms fit is a question for your counsel.
Yes. Tokenization is pseudonymization: whoever holds the token mapping can reverse a token. The CCPA defines pseudonymized data as information that cannot be tied to a consumer without additional information kept separately (1798.140(aa)). Protecto keeps the mapping apart from the model provider, so the provider never holds the real values, but your CCPA duties still apply.
They apply if you use technology that replaces, or substantially replaces, human decisionmaking for a significant decision: lending and financial services, housing, education, employment or compensation, or healthcare services (11 CCR 7001(e), (ddd)). Advertising is not a significant decision. Businesses must comply from January 1, 2027, with a pre-use notice, an opt-out and access rights (7200 to 7222).
No. Consent and opt-out tools manage what you collect and what you tell consumers. DLP watches email, endpoints and the network. Protecto covers the AI data path, where personal information moves into models, vector stores, agent memory and tool calls, and works alongside both.
50+ entity types out of the box across PII, PHI and PCI, including names, Social Security numbers, card and account numbers, addresses and health details. You can add custom entities for identifiers specific to your business.
As Protecto's SaaS, in your private cloud, on your own servers, or air-gapped with a model you host. Protecto holds SOC 2 Type II and ISO 27001.
A framework for finding where sensitive data moves through your AI systems, before a security review or an auditor finds it for you.
By submitting you agree to Protecto’s privacy policy.
A practical guide to privacy controls for AI assistants, RAG, and agents. One workflow traced from request to CRM update, with what each destination may see.
By submitting you agree to Protecto’s privacy policy.