CPRA applies to businesses that collect or process the personal information of California residents and meet certain criteria. It protects various categories of personal data, including sensitive information like Social Security numbers, financial account numbers, and health information.