Your Dispensary Handles Sensitive Data Every Day. Most Don't Have A Privacy Programme To Match
Customer ID scans. Purchase histories. Delivery addresses. Loyalty records. Metrc credentials. California's DCC and CCPA are watching and most cannabis operators are exposed without even knowing it.
I run fixed-scope privacy assessments built specifically for licensed cannabis businesses. You get a clear picture of your risk and a roadmap to fix it, without a law firm bill.
10+ years managing PIAs for regulated telecoms
California cannabis specialist
Fixed-fee, No surprises
100% remote delivery
Cannabis Operators Face A Compliance Gap Most Don't See Coming.
You're licensed, compliant with DCC regulations, and operating legally. But privacy compliance is a different layer entirely and it sits right on top of your customer data, your loyalty platform, your delivery app, and your Metric access.
Here's What's Typically Unaddressed:
-
No CCPA privacy notice at the point of collecting customer ID or contact information
-
Customer ID scans stored indefinitely with no deletion policy
-
Loyalty platforms sharing customer data with third-party advertisers — likely triggering CCPA's data-sale rules
-
Metrc credentials held by former employees with no offboarding process
-
No vendor agreements (DPAs) with your POS, delivery, or CRM platforms
-
No documented plan for what happens when a data breach occurs
A DCC audit, a customer complaint to the CPPA, or a data incident can surface any of these gaps fast. Most operators find out the hard way.
Three Focused Services
Fixed Fees. No Ongoing Retainer Required.
Vendor Privacy Risk Review
$2,200
From
An audit of every third-party platform with access to your customer or operational data — POS systems, loyalty tools, delivery apps, age verification software. You'll know exactly what your tech stack is doing with your data, and whether your vendor agreements protect you.
Delivery In 7 Business Days
Privacy Impact Assessment (PIA)
$3,500
From
A comprehensive assessment of every data flow in your operation — from ID collection at the counter to Metrc reporting to your loyalty platform's third-party integrations. The result is a risk-rated report and a clear remediation plan, built to satisfy DCC and CCPA expectations
Delivery In 10 Business Days
Who This Is For
Built For California's Licensed Operators.
-
Retail dispensaries running loyalty programmes, e-commerce, or delivery
-
Delivery-only operators handling customer geolocation and ID verification
-
Multi-location or multi-licence operators with complex data flows
-
Cultivators and manufacturers navigating DCC data and vendor obligations
-
Any operator who has never had a formal privacy review