California’s Consumer Privacy Act — better known as CCPA — is often assumed to be a law that only affects California-based companies. But for New York businesses that collect, process, or sell personal information about California residents, CCPA compliance can be very much a live obligation. If your New York company has customers, users, or employees in California and meets certain revenue or data volume thresholds, CCPA document destruction New York requirements may apply to your business. Ignoring this law because you’re headquartered in Manhattan, Brooklyn, or Long Island is a mistake that has cost numerous businesses significant regulatory exposure.
CCPA grants California consumers a range of rights over their personal data, including the right to know what data is collected, the right to opt out of data sales, and — critically — the right to request deletion of their personal information. When a consumer exercises a deletion request, your business is obligated to delete the personal information from your records and direct any service providers to do the same. For businesses that retain paper records containing California consumer data, this has direct implications for how and when those records are destroyed. Understanding CCPA document destruction in New York means understanding both the digital and physical dimensions of the law.
Does CCPA Apply to Your New York Business?
CCPA applies to for-profit businesses that do business in California AND meet at least one of the following thresholds: annual gross revenues over $25 million; annually buy, receive, sell, or share personal information of 100,000 or more consumers or households; or derive 50% or more of annual revenues from selling consumers’ personal information.
“Doing business in California” has been interpreted broadly and includes having California customers, running advertising targeting California residents, or having an employee or contractor in the state. Many New York businesses — particularly e-commerce companies, financial services firms, healthcare providers, and professional services organizations — meet these criteria without realizing it. If your business collects personal information from California residents through a website, app, or paper form, CCPA likely applies.
- Revenue threshold: Annual gross revenues exceed $25 million
- Data volume threshold: Process personal data of 100,000+ California consumers annually
- Revenue from data: Derive 50%+ of revenue from selling personal information
- Nexus requirement: Conduct business in California (broadly interpreted)
What Personal Information Does CCPA Cover?
CCPA defines personal information broadly to include any information that identifies, relates to, describes, or could reasonably be linked to a particular consumer or household. This extends far beyond digital records. Paper documents containing customer names, addresses, phone numbers, email addresses, account numbers, purchase histories, or financial information about California residents are all covered by CCPA.
For New York businesses that use paper forms — whether for customer intake, service agreements, credit applications, or subscription sign-ups — any form that captures personal information from a California resident is subject to CCPA’s deletion and destruction requirements. This means your document shredding program must be capable of responding to verified consumer deletion requests in a timely manner, in addition to your regular document retention schedule.
- Names, addresses, phone numbers, email addresses
- Social Security numbers, driver’s license numbers, passport numbers
- Financial account information and credit card numbers
- Medical and health information (also covered by HIPAA for many businesses)
- Commercial information including purchase history and service records
- Biometric data and geolocation information
- Internet browsing history and online activity records printed on paper
CCPA Deletion Rights and Physical Records
When a California consumer submits a verifiable deletion request under CCPA, your business has 45 days to respond and fulfill the request. For digital records, this typically means deleting data from databases and systems. But businesses that retain paper records must also identify and destroy physical documents containing that consumer’s personal information.
This is one area where having an organized, consistent document destruction program makes a significant operational difference. A business that has clear retention schedules and uses locked shredding consoles with scheduled pickups is far better positioned to respond to CCPA deletion requests than one that stores paper records in random filing cabinets with no systematic approach to destruction. For compliance with CCPA and other privacy laws, proper document management infrastructure is essential.
Key aspects of CCPA deletion for paper records:
- Identify all paper records containing the consumer’s personal information
- Determine if any exemptions apply (records needed for legal proceedings, fraud prevention, etc.)
- Securely destroy non-exempt paper records containing the consumer’s information
- Document the destruction with a Certificate of Destruction
- Notify the consumer that their request has been fulfilled within 45 days
- Direct service providers that hold the data to delete it as well
How New York Businesses Can Prepare for CCPA Compliance
New York businesses that are subject to CCPA should take several steps to ensure their physical record-keeping practices support compliance. The foundation is a comprehensive data mapping exercise that identifies what personal information you collect, where it is stored (including paper files), how long you retain it, and how it is ultimately destroyed. This exercise often reveals paper records that have been retained far longer than necessary — creating both legal risk and unnecessary storage costs.
Once you understand your data landscape, work with your shredding provider to establish a destruction schedule that aligns with your retention policy. Records that have exceeded their retention period should be destroyed on a schedule — not held indefinitely. Working with a certified shredding company that provides documented chain of custody and Certificates of Destruction ensures you have defensible evidence of your destruction practices should a CCPA audit or complaint arise.
New York SHIELD Act vs. CCPA: What’s the Difference?
New York businesses should understand that while CCPA is a California law, New York has its own data privacy requirements under the SHIELD Act (Stop Hacks and Improve Electronic Data Security Act). The SHIELD Act requires New York businesses that collect private information about New York residents to implement and maintain reasonable data security measures, including appropriate disposal practices for paper records.
For businesses subject to both CCPA and the SHIELD Act, your document destruction program needs to satisfy both laws simultaneously. In practice, a robust program with scheduled shredding, locked consoles, and documented destruction satisfies the disposal requirements of both laws. For businesses throughout the New York metropolitan area, investing in a professional shredding program is one of the most cost-effective ways to maintain compliance with multiple overlapping privacy regulations.
If you’re uncertain whether CCPA applies to your New York business or how to align your document destruction practices with CCPA requirements, contact New York Shredding today to discuss a compliant destruction program for your organization.
Why New York Businesses Choose New York Shredding
For over a decade, New York Shredding Document Destruction, Inc. has helped businesses across New York City, Long Island, Westchester, and the Hudson Valley protect their sensitive information through certified, HIPAA-compliant shredding services. Our industrial-grade shredding equipment, locked on-site consoles, and Certificate of Destruction give your business the proof it needs for any compliance audit.
Whether you need scheduled shredding, a one-time purge, or hard drive destruction, we serve all five boroughs and surrounding areas with fast, reliable service. Request a free quote today and get your office on a shredding schedule that keeps you protected year-round.
Ready to get started? Contact New York Shredding for a free quote, or explore our full range of shredding services.