Exactly which consumer rights need to be explained in a  privacy notice? The California Attorney General recently addressed this question in responding to comments to final California Consumer Privacy Act (CCPA) regulations.

Q: When drafting a privacy notice, do you need to include only the individual rights which are relevant to your data processing or all of them?

A: Depends on whom you ask.

Under CCPA, the California Attorney General said subject entities must list all rights even if they don’t have to comply.

Under the EU’s General Data Protection Regulation, the European Data Protection Board says in its transparency guidelines: Only list the ones that are applicable to the processing. Doing otherwise may be misleading to the individuals.