California's wider right to delete: what SB 923 means for Philippine vendors

From 1 January 2027, a Californian who asks a business to delete their data can reach information the business got from other sources, not only what they handed over themselves. The law binds the US business. Philippine BPOs, IT-BPM firms and vendors will feel it through their contracts and the deletion instructions that follow.

Key takeaways

• California's SB 923, the Expanding Privacy Rights Act, was signed on 27 September 2026 and takes effect on 1 January 2027.

• The CCPA right to delete will cover personal information a business has collected from or about a consumer, including data bought or received from third parties.

• A business may keep a minimal record of the request so that deleted data stays deleted. Online-only businesses with a direct consumer relationship must offer an online way to submit requests, such as a web form.

• Philippine companies are not bound directly. As service providers and contractors to US businesses, expect wider deletion instructions to arrive through your contracts.

• The practical test is simple: can you find, delete and prove deletion of client data that came from third-party sources?

What the law says

Under the California Consumer Privacy Act (CCPA), the right to delete currently applies to personal information a business collected from the consumer (Cal. Civ. Code §1798.105(a)). Data a business obtained elsewhere, such as purchased lists, enrichment feeds or partner files, falls outside that right. CalPrivacy, California's privacy regulator, describes this as a gap: personal information a business got from a third party could remain after the person asked for deletion.

SB 923 closes the gap. Once in force, a consumer may ask a business to delete personal information the business has collected from or about them. CalPrivacy notes that the existing exceptions remain, for example for fraud prevention, research and compliance with legal obligations.

Two further changes come with it:

• Keeping deleted data deleted. For information obtained from someone other than the consumer, the business may keep a record of the deletion request and the minimum data needed to make sure the information stays deleted and is not used for any other purpose. CalPrivacy calls this a suppression list. Without it, the same record could simply return in the next data feed.

  
  

• An online way to ask. A business that operates exclusively online and has a direct relationship with consumers must provide an online method, such as a web form or online portal, for privacy requests. Until now, an email address was enough.

  
  

What does not change is how deletion travels down the supply chain. When a business receives a verifiable deletion request, it must tell its service providers and contractors to delete the data. They, in turn, must cooperate, delete at the business's direction (or enable the business to delete) and pass the instruction on to their own service providers and contractors. They are not required to act on a request a consumer sends directly to them for data they hold in that role. Under the CCPA, both roles rest on a written contract with the business, and a service provider that engages someone else to help must bind them by written contract to the same obligations (§1798.140).

CalPrivacy says the new standard matches what consumers already have in Delaware, Indiana, Maryland and New Jersey.

Why it matters in the Philippines

SB 923 does not regulate Philippine companies. Its effect here comes through the CCPA's service-provider structure: wider deletion rights for the US business mean wider deletion instructions for the vendors that process its data.

The Data Privacy Act of 2012 (RA 10173) adds a local layer. Section 4(g) exempts personal information originally collected from residents of foreign jurisdictions under their laws and processed in the Philippines. The exemption is narrow. Under the Act's Implementing Rules and Regulations (IRR, Section 5(f)), it covers only the minimum processing needed, the party claiming it must prove the foreign law, and controllers and processors remain subject to the duty to implement security measures. The IRR also expects processor contracts to cover help with data subject requests and the deletion or return of data when services end (IRR Section 44). The same deletion discipline serves both laws.

By audience

• BPOs and IT-BPM firms. Contact centres that take privacy requests, and back-office teams that manage client CRMs, will handle more deletion instructions covering more data. Intake scripts should say what to do when a Californian asks your agents directly.

  
  

• Philippine vendors: dev shops, martech, data and enrichment providers. Data you supply to a US business becomes deletable at that business. Expect clients to ask that suppressed records do not come back in your next delivery. Dev shops building for online-only US clients may be asked for request web forms and portals.

  
  

• SMEs selling online to US customers. Whether the CCPA applies depends on thresholds set in the law; check that first with counsel. If it does and you sell only online, plan an online request form.

  
  

• Enterprises with US operations or parents. Group deletion processes, shared service centres in Manila and suppression-list design should be aligned before January.

  
  

What to do now

This checklist is our practical guidance at PrivaLex, not a regulator's.

1. Map third-party-sourced data. For each US client, list where data from purchased lists, enrichment feeds or partners sits in systems you run.

2. Confirm your role. Read each contract: are you a service provider, a contractor, or a third party that receives data? Your duties differ.

3. Test deletion end to end. Run a test request through every system, including copies and exports, and keep evidence that it was done.

4. Flow the instruction down. Make sure your own subcontractors can delete on your instruction, on the same terms.

5. Set a rule for direct requests. Agree with each client how your team routes a deletion request a consumer sends straight to you.

6. Agree how suppression works. Settle what minimum data is kept, where, who can see it, and that it is used for nothing else.

7. Check your DPA basics. Confirm your security measures and your processor terms under IRR Section 44 are in place.

8. Ask clients early. Before 1 January 2027, ask US clients whether they will update instructions, service levels or contracts.

   
   

Winning and keeping global clients

US clients choose vendors they can trust with their customers' data. A vendor that can show a clean, documented deletion process before the client asks is easier to keep and easier to recommend. It is one of the ways Philippine organizations earn the trust to compete globally.

Frequently asked questions

Does SB 923 apply directly to my Philippine company? No. It amends the CCPA, which binds covered businesses. Philippine firms meet it through their role as service providers or contractors and the contracts behind that role.

When does it take effect? 1 January 2027, according to CalPrivacy.

A Californian emailed us directly asking for deletion. What now? Under the CCPA, a service provider or contractor is not required to act on a request sent directly to it for data held in that role. Follow your contract, which typically means routing the request to your client promptly.

Can a business keep anything after deletion? For data obtained from other sources, it may keep a minimal record so the data stays deleted, used for no other purpose. The CCPA's existing exceptions also still apply.

Does the Data Privacy Act cover Californians' data we process here? Section 4(g) exempts some foreign-collected data, but only narrowly, and security obligations still apply. Get advice on your own facts.

Talk to us

If your US clients are likely to ask how you handle deletion, we at PrivaLex can help you map your data, test your process and review your contracts before 1 January 2027. Book a scoping call or message us at privalex.com.ph.

Sources

• California Privacy Protection Agency (CalPrivacy), "California Expands Privacy Protections by Strengthening Deletion Rights", 27 September 2026: https://privacy.ca.gov/2026/09/california-expands-privacy-protections-by-strengthening-deletion-rights/

• CalPrivacy, "California Legislature Advances Bill to Strengthen Deletion Rights", 28 August 2026: https://privacy.ca.gov/2026/08/california-legislature-advances-bill-to-strengthen-deletion-rights/

• SB 923 (Becker), 2025–2026 Regular Session, approved 27 September 2026. Official page: https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB923 ; chaptered text as mirrored at https://legiscan.com/CA/text/SB923/id/3460510

• California Consumer Privacy Act, Cal. Civ. Code §§1798.105 and 1798.140, as posted by CalPrivacy: https://cppa.ca.gov/regulations/pdf/cppa_act.pdf

• Data Privacy Act of 2012 (Republic Act No. 10173), Section 4(g): https://privacy.gov.ph/data-privacy-act/

• Implementing Rules and Regulations of RA 10173, Sections 5(f) and 44: https://privacy.gov.ph/implementing-rules-regulations-data-privacy-act-2012/