While the California Consumer Privacy Act (CCPA) is a California law, its reach extends well beyond state borders — including to New York businesses that collect, sell, or process personal data of California residents. If your company serves customers in California, CCPA compliance for New York businesses is a real and pressing concern. Combined with New York’s own SHIELD Act, the overlapping requirements create a complex regulatory environment that demands a robust approach to data management and secure document destruction.
Understanding the CCPA’s requirements and how they intersect with existing New York obligations is the first step. From there, businesses need practical compliance strategies — including certified shredding programs that provide documented proof of destruction when personal data is no longer needed.
Who Does the CCPA Apply To in New York?
The CCPA applies to any for-profit business that meets one or more of the following thresholds and collects personal information from California residents, regardless of where the business is located:
- Annual gross revenue exceeding $25 million
- Buys, sells, or receives personal information on 100,000 or more consumers or households per year
- Derives 50% or more of annual revenue from selling consumers’ personal information
Many mid-size and enterprise New York businesses — particularly in e-commerce, financial services, healthcare, and marketing — fall under this scope. If your New York company maintains a website or online platform accessible to California residents and meets any of the above thresholds, CCPA compliance is not optional. Our compliance resource center can help you understand your obligations.
CCPA Data Deletion and Destruction Requirements
One of the most significant consumer rights under the CCPA is the “right to deletion” — consumers can request that businesses delete their personal information and direct service providers to do the same. For businesses that store personal data in physical documents, this creates a clear mandate for secure document destruction.
When a deletion request is received, businesses must:
- Identify all locations where the consumer’s personal information is stored
- Delete the information from digital systems and direct service providers to do the same
- Securely destroy any physical records containing that consumer’s personal information
- Respond to the consumer’s request within 45 days (with possible 45-day extension)
This makes it essential to have a systematic document tracking and destruction program in place. Ad-hoc shredding won’t satisfy regulators who want to see documented, auditable destruction events.
The Role of Secure Document Destruction in CCPA Compliance
The CCPA requires businesses to implement “reasonable security procedures and practices” to protect personal information. This standard applies not just to how data is stored and used, but also to how it’s disposed of. The law explicitly recognizes that data security extends to the secure disposal of personal information when it is no longer needed.
Key document destruction practices that support CCPA compliance include:
- Certificate of Destruction: Provides an auditable record proving that physical documents were destroyed securely and completely
- Scheduled shredding programs: Prevent accumulation of personal data past its useful life, reducing your data footprint and breach exposure
- Cross-cut or micro-cut shredding: Meets the highest standards for making documents unreadable and unrecoverable
- Hard drive destruction: Ensures personal data stored on electronic media is permanently destroyed, not just deleted
Our shredding services include both paper and hard drive destruction, giving New York businesses a comprehensive solution for physical data disposal under the CCPA and other applicable laws.
CCPA vs. NY SHIELD Act: What New York Businesses Must Know
New York businesses subject to the CCPA must also comply with the NY SHIELD Act — and understanding how these laws overlap is critical. While the CCPA is focused on consumer rights and data transparency, the SHIELD Act focuses on security safeguards and breach notification. Both laws require reasonable security practices, including for document disposal.
Key differences and overlaps include:
- Scope: CCPA covers California residents’ data; SHIELD Act covers New York residents’ private information
- Consumer rights: CCPA grants specific consumer rights (deletion, opt-out); SHIELD Act focuses on organizational security requirements
- Breach penalties: CCPA allows private lawsuits for data breaches; SHIELD Act is enforced by the NY Attorney General
- Document destruction: Both require secure disposal of personal information when no longer needed or upon consumer request
New York businesses subject to both laws should adopt a unified compliance approach with a single shredding program that satisfies both sets of requirements. Learn more about our shredding process and how we issue documentation for compliance purposes.
Building a CCPA-Compliant Records Management Program
Meeting CCPA obligations requires more than a shredder in the break room. New York businesses need a structured records management program that includes data mapping, retention schedules, and certified destruction procedures. Here’s a framework to get started:
- Data inventory: Identify all personal information your business collects, where it’s stored, and why it’s retained
- Retention schedules: Define how long each category of data is retained before destruction
- Destruction triggers: Establish clear triggers for destruction — expiration of retention period or receipt of a deletion request
- Certified destruction vendor: Partner with a certified, bonded shredding company that provides a Certificate of Destruction
- Employee training: Train staff on which documents contain personal information and how to handle deletion requests
- Audit trail: Maintain records of all destruction events, linked to deletion requests where applicable
Check our service area to confirm we cover your New York City, Long Island, Westchester, or Hudson Valley location.
Why New York Businesses Choose New York Shredding
For over a decade, New York Shredding Document Destruction, Inc. has helped businesses across New York City, Long Island, Westchester, and the Hudson Valley protect their sensitive information through certified, HIPAA-compliant shredding services. Our industrial-grade shredding equipment, locked on-site consoles, and Certificate of Destruction give your business the proof it needs for any compliance audit — whether you’re dealing with the CCPA, NY SHIELD Act, or any other data privacy regulation.
Whether you need scheduled shredding, a one-time purge, or hard drive destruction, we serve all five boroughs and surrounding areas with fast, reliable service. Request a free quote today and get your office on a shredding schedule that keeps you protected year-round.
Ready to get started? Contact New York Shredding for a free quote, or explore our full range of shredding services.