California DROP: Delete Personal Information Across Document Repositories
Match the person, follow every copy, and keep the deletion in effect
Published
A deletion request matches a consumer profile. The profile disappears, but an attached PDF and its extracted text still appear in search. For California data brokers subject to DROP, the request needs to reach the covered personal information across those connected records.
One request, three connected tasks
- 1 · Match
Find the person and copies
Connect the request to records across systems.
- 2 · Act
Apply the correct outcome
Delete, apply an exception, or opt out as required.
- 3 · Maintain
Report and prevent return
Keep the request effective as new data arrives.
Prepare for the shorter cycle
Current cycle · 2026
45 days
Since August 1, 2026, brokers must access DROP at least this often. The current processing guidance also requires reporting within 45 days of downloading a request.
From January 1, 2027
30 days
AB 883 shortens the cycle. CalPrivacy says deletion requests must be processed at least once every 30 days.
The agency's processing guide identifies the change. Update scheduling, provider turnaround, and escalation before January. Track the next download and each batch's completion deadline separately, with time to resolve failures.
1. Match the request before touching documents
DROP supplies hashed identifiers. Standardise your own identifiers using the agency's exact rules, then compare them. Preserve the work-item ID, batch reference, matching method, and outcome. Repeated downloads or retries should not create conflicting actions.
Once a person is identified, use trusted customer or subject relationships to find the PDFs, versions, attachments, metadata, extracted text, inferences, exports, and provider copies in scope. A name search alone will miss records and can confuse people with similar names.
Matching detail: hashes, list selection, and testing
Use the current data specification for identifier-specific standardisation, SHA-256, UTF-8, Base64 output, and composite hashes. Select lists that cover the identifiers in your records, following the agency's coverage rules. Test with synthetic data in the DROP Sandbox. Hashes still support linking to people; restrict access and avoid placing raw identifiers in general tickets or logs.
2. Choose the outcome the evidence supports
The DROP status reference distinguishes these outcomes. Keep an internal pending or failed state while work remains; a failed deletion is not a “not found” result.
| Finding | Action and reportable outcome |
|---|---|
| Matched consumer | Delete non-exempt personal information, including inferences, and direct providers and contractors accordingly. Report Deleted when the applicable work is complete. |
| Several consumers share the matched identifier | Apply the prescribed opt-out of sale and sharing to all associated consumers and direct providers accordingly. Report Opted out. |
| All matched information is exempt | Record the applicable basis and review. Report Exempted. If only some information is exempt, still address the non-exempt information. |
| No match after completed matching | Report Not found and retain the request for ongoing screening of newly collected information. |
For the opening example, the action plan must cover the profile, attached PDF, historical copies, and extracted text. Give each repository an owner and a verified result. Handle shared documents and any permitted retention through privacy review; a label such as “legal hold” alone does not establish a statutory exception.
Copies, exceptions, and backup handling
The DROP regulations distinguish third-party information from first-party collection and address statutory exceptions and minimum information retained for compliance. Assess which rules apply to each record. They permit delaying deletion in archived or backup systems until restoration or access for sale, disclosure, or another commercial purpose. Document those copies and the controls that apply when they return to use. A restore must not silently reintroduce deleted information into active processing.
3. Report the result and keep the request effective
Return the status against the original work-item ID and retain the processed response, validation errors, and corrections. The technical reference distinguishes an upload being received from processing being complete. Reconcile the returned results to the batch before closing it.
Keep the minimum identifiers needed for future screening, including unmatched requests, and use them only for compliance. Check newly collected information before sale or sharing. Apply required recurring deletion and status updates; a completed batch does not end the obligation. The agency's ongoing-requirements guidance describes this continuing work.
Retain a minimal action record: request reference, systems checked, decision basis, completed actions, provider results, exceptions, and reported status. Logs and evidence can themselves contain personal information. Avoid copying the deleted content into a permanent “proof” file, and review access and retention for the compliance record.
Test the full request with a controlled record
- Find it: can matching locate the person and every covered document representation?
- Act on it: do deletion, exception, and shared-identifier paths produce the correct outcomes?
- Confirm it: are provider and DROP processing failures visible to an owner?
- Keep it effective: does a later import or restore trigger the required screening and action?
Keep the deletion effective across the copies
Connect each request to the matched person, covered records, required actions, and reported outcomes. Verify the affected copies and provider results, retain only the compliance information needed, and keep screening later imports and restored data so completed work remains effective.