Documenting service-provider deletion asks for DROP

This is an operations guide for your own records. It is not legal advice and not an audit standard.

Why a record shows up on a DROP desk

CalPrivacy’s processing guidance tells brokers that when they find a match they must delete non-exempt personal information and direct all service providers and contractors to delete matching records. In the multi-consumer identifier case, brokers must opt associated consumers out of sale or sharing and direct providers accordingly.

Source: Processing DROP requests.

Separately, public comment materials around DROP audits have discussed evidence that instructions were sent downstream and what came back. Those materials are part of a policy conversation, not a finished checklist you can treat as law. When you quote them, label them as commentary.

Example commentary PDF: DROP Audits preliminary comments.

What to inventory once

For each service provider or contractor, write down:

• Legal name and common name, so answers are not filed under the wrong vendor.
• What they hold: identifiers, derived data, and the scope of the ask.
• How you instruct them: email, portal, or ticket.
• Who on your side owns follow-up.
• What confirmation you expect: an acknowledgment, or a richer confirmation.
• Where confirmations are stored: one folder per cycle.

Update the inventory when you add or drop vendors. Do not rebuild it inside a live 45-day window, or later a 30-day window.

What to capture per cycle, per vendor

1. Cycle id, window start, and window due. Those are your planning times.
2. Batch or request-set id you are working.
3. Time the instruction or acknowledgment link was sent.
4. Reminder times, if any.
5. Response type: acknowledgment, exception plus reason, or no response at close.
6. A short operator note.
7. Export checksum when you freeze the file.

Richer fields, only if your counsel wants them: ticket ids, contract clause references, and hashed request counts. Avoid storing unnecessary personal information in the evidence pack.

Acknowledgments and deletion confirmations

Keep the language honest in every PDF and CSV.

• An acknowledgment means the vendor said they received the instruction, or filed an exception.
• A deletion confirmation is a stronger claim about their systems. Record it only if they actually gave you that, and treat it as their statement, not yours.

Drop Ledger’s export is a record, not a finding. Keep that discipline in your own templates.

A file layout that survives staff turnover

/cycle-2026-11-autumn/
  batch.csv
  vendors.csv
  acknowledgments/
  exceptions/
  export.pdf
  export.sha256

Use stable request_id values in CSVs. The sample file uses request_id,identifier_type,identifier_value. See the sample deletion-requests CSV.

Cadence reminder

Recurring processing is published as at least every 45 days now, moving to at least every 30 days effective January 1, 2027 (AB 883), per CalPrivacy’s broker pages. Documentation habits should still work when the calendar tightens.

Sources: DROP for data brokers, Processing DROP requests.

Where Drop Ledger fits

Drop Ledger organizes vendor asks, private acknowledgment links, reminders, and watermarked or full exports depending on plan. It does not access DROP, does not delete data, and is not legal advice.

Demo · Pricing (Cycle $149 / Evidence $249 / Ops $299 founding monthly)

Sources

1. Processing DROP requests
2. DROP for data brokers
3. CPPA DROP regulations page
4. Commentary only: DROP Audits preliminary comments PDF