August 1 is not just another compliance deadline.

For organizations that fall under California’s Delete Act, it marks the start of a new operational requirement: continuously retrieving, processing, reporting on, and maintaining deletion requests submitted through DROP.

During our recent webinar featuring CalPrivacy, the California Privacy Protection Agency, we discussed what privacy teams need to understand before August 1, from applicability and data broker misconceptions to hashed identifier matching, suppression management, engineering workflows, and audit readiness.

Here are ten practical lessons every privacy team should take away.

1. Don't Start by Asking "Are We A Data Broker?"

Start with a better question:

What data activities does our organization perform?

One of the biggest misconceptions around the Delete Act is that organizations immediately rule themselves out because they do not think of themselves as “data brokers.”

But applicability is not only about how a company describes itself. It depends on what the organization does with personal information: how it collects it, where it comes from, whether it is enriched, how it is shared, and whether it is sold or made available to third parties.

Activities such as purchasing third-party data, enriching customer records, using tracking technologies, licensing data, or sharing information with partners may be more relevant than the label itself.

Rather than starting with a narrow definition, organizations should first build a clear picture of how personal information moves through the business.

Bottom line: Understanding your data activities is the fastest way to determine whether the Delete Act deserves a closer look.

2. "Selling" Personal Data is Broader Than Most Teams Realize

Another common misconception is that selling personal information only means exchanging data for money.

Under the CCPA, the definition is broader. It can include disclosing, releasing, transferring, or otherwise making personal information available in exchange for monetary or other valuable consideration.

That means some organizations may already be engaging in activities that qualify as selling without realizing it.

This does not automatically make every organization a data broker. But it does mean that assumptions can be risky, especially when data is being exchanged, enriched, licensed, or shared across a broader ecosystem of partners and vendors.

Bottom line: Do not rely on a narrow interpretation of “selling.” Assess how personal information is actually exchanged across your organization.

3. A Direct Customer Relationship Doesn't Automatically Exempt You

Many organizations assume that having a direct relationship with customers automatically places them outside the Delete Act’s scope.

Not necessarily.

The webinar highlighted a more nuanced distinction. A company may have first-party customer data from a direct interaction, but it may also enrich that data with third-party information and later sell or share the enriched data.

In that scenario, the first-party relationship does not automatically resolve the question. The key issue is what information was collected directly, what information was obtained from outside sources, and how that enriched information is used or shared.

In other words, applicability depends on the full data lifecycle, not simply whether customers know who you are. Even if your organization ultimately determines that it isn't a data broker, understanding these data flows is valuable preparation for broader privacy compliance efforts.

Bottom line: Focus less on organizational labels and more on how personal information is collected, enriched, and shared.

4. Your Biggest Delete Act Risk May Sit Outside The Privacy Team

Delete Act readiness is not just a privacy initiative.

Some of the most relevant signals may sit with marketing, growth, analytics, partnerships, sales operations, or engineering teams. These teams often manage the activities that determine applicability, including purchased lists, enrichment workflows, advertising technologies, analytics platforms, audience segmentation, data licensing, and third-party integrations.

That is why privacy teams cannot assess Delete Act readiness in isolation.

The right stakeholders need to be involved early, especially the teams that understand where data comes from, how it is used, what systems process it, and which third parties receive it.

Bottom line: The sooner you engage the right stakeholders, the easier it becomes to assess obligations and avoid surprises later.

5. Data Mapping Is the Fastest Path to Readiness

Before an organization can confidently determine whether the Delete Act applies, it needs a clear understanding of its data ecosystem.

That means answering practical questions:

Where does personal information originate?

Which systems process it?

Is it enriched with third-party data?

Which vendors, partners, or platforms receive it?

Which identifiers are stored?

Which data is exempt, and which data may be in scope?

Privacy teams do not need every legal answer before they start this work. In fact, data mapping is what makes those legal answers possible.

It also creates value beyond the Delete Act. The same visibility supports DSR workflows, vendor governance, AI governance, consent management, and broader privacy operations.

Bottom line: Organizations that understand their data flows today will be significantly better prepared for August 1 and for future privacy requirements.

6. August 1 Is Only The Beginning

August 1 is not a one-time milestone. It is the start of an ongoing operational process.

Once DROP processing begins, organizations that fall under the Delete Act will need to retrieve deletion requests, process them, report status, and continue maintaining those requests over time.

That distinction matters.

This is not a one-and-done compliance exercise. It is a recurring workflow that needs ownership, monitoring, technical infrastructure, and evidence. As more consumers submit requests through DROP, organizations will need a process that can scale beyond the initial batch.

The real challenge is not just being ready for August 1. It is building a program that can keep running after August 1.

Bottom line: Build for continuous compliance, not a one-time deadline.

7. Engineering Needs to Be Involved Now

DROP compliance is not only a legal interpretation exercise. It requires technical execution.

Organizations need to understand how to work with hashed identifiers, normalize internal data, match requests against existing systems, report status back to DROP, and maintain suppression workflows over time.

For many companies, this will require collaboration between privacy, legal, engineering, data, and product teams.

Existing DSR workflows may provide a helpful foundation, but DROP introduces additional requirements and operational complexity. The scale is different. The identifier matching process is different. The suppression requirement is different. And the reporting workflow needs to be repeatable.

The earlier privacy and engineering teams begin working together, the more time they have to validate workflows, automate repetitive tasks, monitor failure points, and reduce operational risk before August 1.

Bottom line: Successful DROP compliance depends on close collaboration between privacy and engineering, not one team working alone.

8. Compliance Doesn't End After Deletion

Deletion is not the end of compliance.

Organizations must also prevent deleted individuals from being reintroduced into their systems as new data is collected, purchased, enriched, or ingested.

That makes suppression management one of the most important operational requirements under DROP.

A suppression list needs to be maintained over time and checked against future data ingestion workflows. This is especially important for organizations that regularly onboard new data from third-party sources, enrich existing records, or update databases from external partners.

Without suppression management, a company may delete a consumer’s information today only to reintroduce it tomorrow.

Bottom line: Build compliance into the full data lifecycle, not just the deletion process.

9. Build for Auditability from Day One

Compliance does not end once a request is fulfilled. Organizations also need to show that requests were handled correctly.

Although the Delete Act’s independent audit requirements begin in 2028, auditability should not wait until then.

Privacy teams should start building records of requests, decisions, actions taken, systems checked, statuses reported, suppression activity, and exceptions. These records help demonstrate that the organization has a repeatable, defensible process.

They also make it much easier to investigate issues, respond to internal questions, work with counsel, and prepare for future audits.

Trying to reconstruct evidence later is much harder than capturing it as part of the workflow from the beginning.

Bottom line: An audit trail is not just a future requirement. It is the foundation of a resilient compliance program.

10. The Best Time to Prepare Is Before August 1

The most important takeaway from the webinar was simple: start now.

Organizations that begin preparing before August 1 have time to assess applicability, understand data flows, engage stakeholders, involve technical teams, design workflows, test matching logic, build suppression processes, and create audit-ready records.

This work also has value beyond a single regulation.

California is unlikely to be the last state to move in this direction. Similar requirements are already emerging elsewhere, and privacy teams should expect more operational privacy obligations in the years ahead.

Preparing for the Delete Act is not just about meeting one deadline. It is about building the infrastructure for a privacy program that can adapt as regulations evolve.

Bottom line: DROP readiness is not just a compliance project. It is a step toward a more operational, scalable, and future-ready privacy program.

What's Next: Turn DROP Readiness Into an Operating Model

The California Delete Act introduces more than a new deadline. It introduces a new operating model for privacy compliance: continuous, technical, repeatable, and evidence-driven.

Whether your organization ultimately qualifies as a data broker or is still assessing applicability, the work starts with the same foundation: understand your data flows, involve the right teams, define the technical workflow, and build processes that can scale beyond the first batch of requests.

Mine’s end-to-end DROP Compliance solution helps privacy and engineering teams operationalize the full lifecycle, from hashed identifier matching and deletion orchestration to suppression management, reporting, and audit-ready records.

Want to see it in action? Join us on July 14 for DROP Compliance, End-to-End: A Live Mine Walkthrough, to see how Mine automates the full DROP compliance lifecycle, from hashed identifier matching and deletion orchestration to suppression management, reporting, and audit-ready evidence.

‍