The new framework departs from earlier state privacy laws in one important way: it treats operational evidence — not published policies — as the measure of compliance. For mid-market companies without a dedicated privacy office, that changes the order of operations.
Start with the data map
Regulators will ask what personal data you hold, where it lives, and who touches it. A defensible answer requires a current data inventory — and building one takes longer than any other step in the program.
“Companies that treat the data map as a one-time project fail the second audit. It has to be an operating document.”
Then fix the vendor layer
Most first-round enforcement actions to date have turned on processor agreements: missing flow-down clauses, undefined deletion obligations, or no audit rights. Renegotiating key vendor contracts now is cheaper than remediating them under a deadline.
What can wait
Consent-banner refinements and cookie-classification disputes draw attention, but they are rarely where liability concentrates. Sequence them after the structural work.
Build the rights-request pipeline
Access, deletion, and correction requests arrive whether or not a process exists to receive them, and the statutory response clock starts on receipt — not on the day the request reaches the right inbox. Mid-market companies rarely need workflow software on day one; they need a designated intake address, a documented routing path, and a template response set that legal has reviewed once rather than under deadline pressure each time.
The verification step deserves particular care. Over-verifying identity frustrates legitimate requests and has drawn regulator criticism of its own; under-verifying turns the rights process into a data-breach vector. The workable middle is matching the verification burden to the sensitivity of what is being released, and writing that logic down before the first contested request arrives.
Documentation regulators expect
Examiners reviewing early cases have converged on a short list: the data inventory, processor agreements with their flow-down clauses, records of rights requests and their resolution timelines, the risk assessments the statute requires for targeted advertising and profiling, and evidence that someone with authority reviews the program on a schedule. None of these documents is difficult to produce prospectively. All of them are nearly impossible to reconstruct credibly after an inquiry letter arrives.
The assessments are the piece most often missed. They read as bureaucratic overhead until the first enforcement sweep asks for them by name — as the early sweeps in other states did. A two-page template, completed honestly for each covered processing activity, satisfies the requirement and disciplines the underlying decisions.
A ninety-day sequence that works
For companies starting from a standing stop: spend the first month on the data inventory and a gap assessment against the statute; the second on processor-agreement triage, starting with the vendors that touch the most sensitive categories; and the third on the rights-request pipeline, the required assessments, and a board-level briefing that fixes ownership of the program going forward. That sequence will not finish the work — but it puts the highest-liability items first and produces the documentation trail that shortens every conversation with a regulator afterward.
Where the thresholds actually land
The coverage math surprises most mid-market executives. Earlier state laws keyed coverage to consumer-data volume in ways that left many business-to-business companies out; the new framework counts employee and job-applicant data toward its thresholds and drops the revenue floor to a level that captures most companies above twenty-five million dollars in annual revenue. A manufacturer with no consumer-facing business at all can be squarely covered on the strength of its HR systems and its marketing database alone.
The employee-data point deserves emphasis because it moves the compliance work into systems legal departments rarely inventory: applicant-tracking software, benefits platforms, workforce-analytics tools, and the monitoring products IT deployed during the remote-work shift. Each of those vendors belongs in the processor-agreement triage, and several of them will be the hardest to renegotiate.
The board conversation
Directors do not need the statutory detail, but they do need three numbers: what coverage costs to establish, what the penalty exposure looks like per violation, and how long the program takes to stand up against the enforcement date. Bringing that framing to the board early does more than secure budget — it creates the documented oversight record that the framework, like the cybersecurity rules before it, increasingly treats as part of compliance itself.