New legislation could shake up consumer data collection in California.

The California Right to Know Act, which was introduced this week, would require companies to provide a comprehensive disclosure of all personal information collected about an individual, as well as all the ways that data is being used.

The legislations builds on a 2003 California law with similar but more limited provisions which has become increasingly difficult to enforce as technology has advanced. 

But will the weight of new regulations fall heaviest on the many small businesses and start-ups that call the Golden State home?

“We’ve tried to write this around making compliance as light of a burden as possible,” Chris Conley, Technology and Civil Liberties Policy Attorney for the American Civil Liberties Union (ACLU) of Northern California, told Inc., which is part of an eclectic group of public interest, consumer privacy, and domestic violence organizations supporting passage of the law.

To that end, says Conley, companies are only required to provide information if it’s “reasonably available”—so if you’re not collecting and using consumer data, you don’t have to worry about disclosing it.

Additionally, if companies don’t want to provide individual reports, they have the option of posting a notice that makes it clear to all consumers what data is being collected and shared, and with whom. Disclosures are only required once every 12 months per individual to prevent companies from being overrun with repeat inquiries.

“The law would give business the option to respond to consumer requests for information, or companies can find mechanisms for giving consumers real time information for how their information is disclosed to third parties," said Conley.

“The first choice is on the business, but either way consumers will have some opportunity to get information about what information is held by a company.”