Build this list before the cycle clock is running. This note is not legal advice.
Why inventory first
CalPrivacy’s processing guidance says that when you find a match you must delete non-exempt personal information and direct all service providers and contractors to delete matching records, or opt out of sale or sharing in the multi-consumer case.
Source: Processing DROP requests.
If you discover a forgotten vendor late in a 45-day window, the desk work piles up. Inventory is the step that prevents that.
Template fields
Copy these columns into a spreadsheet. The examples are placeholders, not a real vendor list.
- Vendor legal name. Example: Acme Analytics LLC. A stable filing key.
- Common name or product. Example: “Audience append.” Staff shorthand.
- Relationship. Service provider, contractor, or another label your counsel uses.
- What they hold. Email hashes, MAIDs, derived scores, or similar. This is about match relevance, not a consumer row.
- Systems or regions. Example: a named SaaS product, US-only.
- Instruction channel. A privacy address, a portal URL, or a ticket queue.
- Expected reply. An acknowledgment, or the exception reasons you accept.
- Owner on your side. A name.
- Contract clause pointer. Optional, and counsel-owned.
- Last inventory review. A date.
- In scope this cycle? Yes or no. A per-window filter.
- Notes. Keep them short.
Do not paste raw consumer personal information into the inventory sheet. Keep the inventory about vendors and channels, not DROP list rows.
How to fill it in one afternoon
- Start from contracts, data-processing agreements, and the runbook of who receives your exports.
- Add subprocessors your primary vendors disclosed, if your counsel wants them tracked.
- Mark anyone who only receives aggregated stats, with no consumer identifiers, as out of scope only after counsel agrees.
- Confirm the live email or portal. A bounced address stalls the cycle.
- Store the sheet where the cycle owner can edit it, and version it when vendors change.
Tie-in to each DROP cycle
For vendors marked in scope for this cycle:
- Send the instruction or acknowledgment link when a match requires it.
- Log sent time, reminders, and replies in the cycle record.
- Export the cycle file when the window closes.
See also How to notify vendors during a California DROP deletion cycle and Documenting service-provider deletion asks for DROP.
Cadence reminder
Recurring processing is published as at least every 45 days now, moving to at least every 30 days from January 1, 2027 (AB 883), per CalPrivacy’s broker pages. A current inventory matters more as that calendar tightens.
Sources: DROP for data brokers, Processing DROP requests.
Where Drop Ledger fits
Drop Ledger stores the vendors you ask, private acknowledgment links, reminders on the desks that include them, and exports. It does not build this inventory for you, and it does not access DROP. Free includes one cycle, up to three vendors, and a watermarked export preview. Paid desks add more vendor seats and the full export.