The implementation of CPRA and introduction of civil penalties for theft of login information should encourage businesses to establish a strong data security posture management (DSPM) strategy. This is a key first step to protect and monitor personal information more effectively and allow consumers to control data sharing.