During the rulemaking process, the Office of the Attorney General was requested to clarify that a business is not required to search for, and produce, “unstructured data” such as paper records in response to an access request.¹ The Attorney General declined the request, stating that the exclusion of “all unstructured data is not as effective in carrying out the purpose and intent of the CCPA because it would allow businesses to maintain, use, or share data that they do not disclose to consumers in response to a request to know. . . .”² Instead, the final regulations excluded from the scope of an access response personal information that was not maintained in a searchable format if the following three conditions were met:

1. The business maintained the data solely for legal or compliance purposes;

2. The business does not sell the personal data and does not use it for any commercial purposes; and

3. The business describes to the consumer the categories of records that may contain personal information that it did not search.³

¹ FSOR Appendix A at 330-31 (Response 977).

² FSOR Appendix A at 330-31 (Response 977).

³ CCPA Reg. 999.313(c)(1)-(3).