Privacy Impact Assessment (PIA / DPIA)
The most thorough privacy review a cannabis operator can have. A PIA documents every personal data flow through your business from the moment a customer shows their ID to how your vendors handle that data downstream and assesses each against CCPA, CPRA, and DCC requirements.
This is the document that demonstrates regulatory good faith to the DCC, satisfies enterprise customer vendor questionnaires, and gives your legal team something solid to work with.
What the assessment covers
-
Customer data flows: ID, purchase history, loyalty, delivery, online ordering
-
CCPA/CPRA consumer rights fulfilment: notice, access, deletion, opt-out
-
DCC regulatory data: Metrc access controls, seed-to-sale data security, record retention
-
Age verification and ID scan data handling
-
Vendor and third-party data sharing — including loyalty, analytics, and marketing platforms
-
CCTV and physical security data
-
Employee data and HR system compliance
-
Incident response readiness
What you receive
-
Completed PIA report with risk ratings for every data category
-
Prioritised remediation log with actions, owners, and timelines
-
Vendor DPA gap list
-
Executive summary suitable for board or management review
-
One-hour debrief call to walk through findings
Invest
From $3,500
(fixed fee)
Multi-licence or multi-location operators quoted individually.
TIMELINE
10 business days
From signed agreement and completed intake form
FORMAT
Word document + PDF
From signed agreement and completed intake form
SUITABLE FOR
Any licensed operator: retailer, delivery, cultivator, manufacturer, distributor