In plain terms
It was created by the California Privacy Rights Act and is the first standalone privacy regulator in a United States state. It writes regulations, takes registrations and fees, publishes the public data broker registry, operates DROP, and brings enforcement actions. Its consumer facing material sits on privacy.ca.gov, and the data broker portal it runs is a separate sign in. When a broker asks who decides what the rules mean in practice for the registry and for DROP, this is the answer.
What it means for a registered broker
Every deadline you carry runs to it, and the registry entry it publishes about you is what anybody checking will see first. Its published enforcement actions against unregistered brokers are a reasonable guide to what it treats as worth pursuing, and the amounts in them read as arithmetic rather than discretion. Keep the contact address on your account current, because DROP delivers validation outcomes and account notices by email, and an address nobody reads is how a rejected status file quietly becomes a missed cycle.