"Now you have data in a lot of places, and so to automate something like 'what information do you have about me,' you have to pull from multiple places. And to build a system that can integrate all that can be very difficult," Winterfeld said.

For some companies, he added, building such a system isn't economical. "Part of that is how many people are going to require this. … If five people want their data to be deleted, automating it doesn't make financial sense, you won't get a return on investment," he said.

Most companies said the CCPA compliance challenges they faced were both internal and beyond their control. Slightly less than half of all respondents cited a lack of consistency between the CCPA and other privacy regulations (47%) , and a lack of visibility into what data they hold (46%) as a barrier to compliance. Around 40% also said inadequate technology infrastructure and inadequate implementation time were challenges, while 36% cited a lack of data education.

Winterfeld noted the challenge of "data education" includes making sure all departments and employees within a company understand how to comply with CCPA. For example, "you don't have marketing go hire a company that is not compliant with the requirements," Winterfeld said. He said companies have to make sure "data is treated in accordance to those corporate policies that allow the company to be compliant."

While attorneys have a pivotal role making sure employees adhere to regulatory requirements, they are often not the ones overseeing their organization's CCPA compliance. According to the survey, most companies either relied on their chief information officer, 32%, or their chief technology officer, 29%, to manage their compliance effort, while only 18% gave the responsibility to their chief legal officer. Nine percent also had their chief customer officer spearhead the effort, while 8% turned to their chief privacy officer and 3% their chief marketing officer.