# v1.2 Legal and Policy Source Receipts

Verified against official California Legislative Information via Firecrawl on 2026-10-04:

- Civil Code §1798.90.51 — operator policy must address collection/use/maintenance/sharing/dissemination; authorized roles/training; monitoring; sharing/transfer; custodian/owner; retention and destruction process.
- Civil Code §1798.90.52 — access record includes date/time, query elements, username/organization, and purpose; access limited to authorized purposes.
- Civil Code §1798.90.53 — end-user policy includes monitoring and a process for periodic system audits, plus sharing/transfer, custodian/owner, retention/destruction.
- Gov. Code §7922.525(b) — reasonably segregable portions available after exempt portions deleted.
- Gov. Code §7922.530 — identifiable nonexempt records promptly available; not a fixed final-production deadline.
- Gov. Code §7922.535 — 10-day determination/notice rule; written unusual-circumstances extension subject to statutory limits.
- Gov. Code §7922.540 — written partial/complete denial; names/titles of persons responsible; withholding must be justified.
- Gov. Code §7922.600 — duty to assist includes identifying responsive records, describing IT/physical location, and suggestions to overcome practical access barriers.

Project-produced-source cross-checks:
- VCSO Policy 429: department-approved training; five-year server retention with exceptions; regular audits; inter-agency agreement/access controls.
- Flock order form: `Retention Period: 365 Days`; extended retention up to one year.

Editorial rule: distinguish (1) what a law requires an agency/operator to maintain or put in policy, (2) what CPRA requires to be disclosed, and (3) whether the produced evidence demonstrates compliance. Do not collapse these into one claim.