Shutterstock

California Consumer Privacy Act (CCPA) compliance is likely to be a long and expensive ordeal, according to a survey of 250 executives and managers at U.S. technology, manufacturing, financial services, utilities and health care companies.

The state's forthcoming privacy regulation, which is scheduled to take effect on Jan. 1 2020,  empowers Californians with more control over the way their data is collected, shared or viewed by U.S. companies on a daily basis. According to the survey, a large majority of respondents, 71 percent, expect to spend at least $100,000 on compliance efforts. But consulting attorneys may not wind up seeing as much of that money as one might think.

“The legal fees are going to play a role, but I don't think the legal fee is going to be the largest chunk of the expense. It will really be the in-house kind of grind that needs to be done in order for the compliance steps to be in place,” said Jarno Vanto, a shareholder at Polsinelli.

The “grind” he's referring to includes extensive work around understanding what data an organization holds and mapping the flow of that data. It also includes checking in with third party vendors and partners to determine what information they have access to as well.

Some seem to be feeling the anxiety more than others. According to the survey, only 14 percent of respondents are already CCPA compliant, while an additional 44 percent haven't even begun taking steps towards full compliance.

The survey was conducted by Dimensional Research on behalf of the privacy compliance company TrustArc. Chris Bable, CEO of TrustArc, attributed some of the compliance delay to companies that have never had to wrap their heads around these issues before. While the European Union's General Data Protection Regulation (GDPR) impacted only U.S. companies with business interests in Europe, the CCPA hits a little closer to home.

“One of the pieces that I had underestimated was truly the amount of companies that were not impacted by GDPR, so CCPA is their foray into doing this,” Babel said.

Vanto thinks the delay can be partly explained by a lack of detail surrounding exactly what will be expected under the CCPA as well.

“There's been talk about it for a good long year, companies are doing a lot. It's just that we are still missing the implementing lens …from the state attorney general of Califonia,” Vanto said.

So how are companies planning on making the leap before the CCPA's January 1 2020 deadline? According to the survey, 72 percent of respondents plan on investing in some sort of technology to help smooth the way.

Babel believes this represents an evolution from the days pre-GDPR, when technology was used mainly for some of the more basic, check-the-box type compliance activities. The CCPA forces companies to understand the “why” and “how” of their data collection operations, requiring more complex solutions that are directed towards managing that flow of information.

“It doesn't mean that you still don't need legal advice, that you don't need consulting advice. … It just means that they kind of go hand-in-glove together,” Babel said.