Cal. Civil Code § 1798.16

(a) Whenever an agency collects personal information, the agency shall maintain the source or sources of the information, unless the source is the data subject or he or she has received a copy of the source document, including, but not limited to, the name of any source who is an individual acting in his or her own private or individual capacity. If the source is an agency, governmental entity or other organization, such as a corporation or association, this requirement can be met by maintaining the name of the agency, governmental entity, or organization, as long as the smallest reasonably identifiable unit of that agency, governmental entity, or organization is named. (b) On or after July 1, 2001, unless otherwise authorized by the Department of Information Technology pursuant to Executive Order D-3-99, whenever an agency electronically collects personal information, as defined by Section 11015.5 of the Government Code, the agency shall retain the source or sources or any intermediate form of the information, if either are created or possessed by the agency, unless the source is the data subject that has requested that the information be discarded or the data subject has received a copy of the source document. (c) The agency shall maintain the source or sources of the information in a readily accessible form so as to be able to provide it to the data subject when they inspect any record pursuant to Section 1798.34. This section shall not apply if the source or sources are exempt from disclosure under the provisions of this chapter.