The countdown to the California Consumer Privacy Act's implementation is ticking.

With less than six months to go until the privacy regulation's Jan. 1, 2020, enforcement date, many departments are still grappling with what compliance looks like. The CCPA is the first U.S. state privacy act, so there's not a clear roadmap for legal teams.

Corporate Counsel spoke with Laurie Fischer, managing director at HBR Consulting, about the biggest challenges and success strategies she's seeing from in-house teams taking on CCPA compliance. This interview has been edited for clarity and length.

Corporate Counsel: What should legal departments be doing right now to prepare for the CCPA? 

Laurie Fischer: The No. 1 thing organizations are looking to do is first identify the scope of consumer data. Where are you most likely to have consumer data? That's typically going to be sales and marketing, finance because you've got accounts receivable, or warehouse distribution and shipping.

Organizations would be smart to develop a targeted data map, so not only what is the data and where is the data. How is it collected? Where is it shared? All the things a California consumer could ask for should be part of your data map.

CC: I've heard that advice, that in-house counsel need to start "mapping" their company's data. But what does that actually mean? How can you figure out where that data is? 

LF: Most [information technology] organizations have some kind of application portfolio. A lot of the time you can look at that and say, "What are the major systems likely to have consumer data?" And then go out and talk to both IT and the business owners of that system to identify that flow and where consumer data is.

The real challenge is all the end users who are using their network shared drive or share point and they're, in an ad hoc fashion, creating, storing and receiving information. That's where you almost have to get to the end user level.

There are also some technology tools. We see a lot of organizations investing in those. Tools are great, but they're not a magic wand. You can't just let it loose and say, "This solves all my problems." Because you still may need to go through the interview process with all the end users to get the specifics.

CC: So legal needs to work with IT? 

LF: It definitely takes a village. The legal department can't do it on their own. It takes this collaborative team of IT, security, compliance if you have one, privacy and legal.

Once you've got your team in place and start delving into where the data is, the nature of the data, then you've got to start thinking about developing a consumer request response policy and procedure. Making that available so consumers can submit requests for access, deletion, to stop the share or sale of their personal information. Some kind of procedure to make sure that you are responding within 45 days.

CC: It's nice to have a procedure written down, but how do you make sure it's actually going to work when the CCPA hits? 

LF: Procedure has to document a process that's already in place.

Once you know where data is, with that team you need to go through each of the potential request types. I want to know what categories of data were collected in the past 12 months. I want to know the source that data came from. I want to know if you shared my data with third parties.

Going back to the data map, think of it as a big spreadsheet, you have to be able to fill that in for each data type. Then you have a request form that's available to the consumer. They will out and say, "This is the type of data I want to know." It's going to fall primarily on the shoulders of IT. IT has to be able to respond to that within 45 days.

CC: How many legal departments' companies are already ready for that? 

LF: I don't think many of them are. This is a challenge. This is not something that's, "Oh, we'll spend a month on this."

You're going to do everything possible to be compliant by Jan. 1, but what if you can't? What if it is just so expensive, so resource-intensive that there is no way you can do this. What we're recommending is prioritize. What is the absolute, most sensitive data? Do that first, and then go down the line so you have a prioritized plan.

Our experience is that if you have a plan in place and if you are making progress to that plan, the potential for fees or adverse action is going to lessen.

CC: What should legal departments prioritize for compliance? 

LF: There's been a lot of discussion about employee data, whether that's in, whether that's out. I think the priority, if you really want to hit the CCPA deadline, is focusing on consumer data at this point.

Understand that the other data may become important, but from a priority perspective: what consumer data do we have, where is it and how would we delete it? How would we respond to these requests?

CC: What aspects of the CCPA that are most challenging for legal departments, from what you're seeing? 

LF: Definitely those consumer requests to be removed from the system. It's one thing to just ask for information but then to say, "Now you've got to remove me." Many of these large systems that contain consumer information are not easily configured to just remove one person's information. That's going to take some additional resources from information technologies.

Another trend we see in a lot of organizations is that they are really evaluating both their existing software and IT solutions to determine if there are solutions out there that may make some of this easier. You have to balance between the cost of those solutions and how big of a challenge it is for you.

There are also some proactive things that people aren't thinking about because they're freaking out now. Where we run into challenges is on the end-user level, who might be in sales and marketing or consumer care, who is taking in consumer information and isn't aware that it either shouldn't be collected or it should be documented so all data sources are covered. I think there is an employee awareness and education opportunity here.

CC: What are successful legal teams going? 

LF: They have a close partnership with IT and privacy, wherever that falls in the organization. A corporate legal department is not going to be able to do this on their own. They really need the help of the IT department and again I see some close alliances forming there.

I think they have a really good understanding of how the law impacts them. I see a number of them also conduct a gap analysis. Really trying to understand what are we doing today, not only where is our data, but what types of tools do we have in place to protect that data and where are our key gaps. Then prioritizing remediating those gaps.