The revision builds upon existing requirements and introduces new obligations for in-scope organizations, including formal risk assessments, annual cybersecurity audits and enhanced consumer rights processes related to the use of automated decision-making technologies.1 By April 1 of each year, businesses must submit a certification to the CPPA that it has completed its cybersecurity audit which must be signed by a member of the business’s executive management team attesting to responsibility for its content and to the report’s accuracy. Organizations must submit specific information to the CPPA including the number of risk assessments conducted or updated during the covered period, the categories of personal information included in those assessments and a written certification under penalty of perjury attesting to completion and accuracy. For each third-party vendor that receives personal information, review whether the contractual relationship and the vendor’s actual data practices qualify it as a service provider under the CCPA. If it doesn’t qualify, the relationship may constitute a sale or sharing of personal information — which triggers an assessment requirement before you onboard the vendor. Risk assessments must also be completed before initiating the processing, reviewed and updated at least every three years or sooner if material changes occur (within 45 days), and retained for as long as the processing continues or for five years after completing the assessment.

It is that multi-state assessment obligations are already overdue for many organizations, and California’s filing requirement creates both the incentive and the accountability structure to close those gaps. Companies that build a risk assessment program to comply with California’s requirements in 2026 and 2027 can use that same program to retroactively document the assessments other states have been requiring since 2023. The introduction of California’s more visible and more enforceable regime creates the opportunity to address it systematically. The operational implication is that risk assessments under the CPPA regulations cannot be completed in isolation by a privacy attorney drafting a template.

Businesses subject to the CCPA will be required to conduct independent annual cybersecurity audits, covering core components of their cybersecurity programs, if their processing presents a “significant risk” to the security of California consumers. Businesses can also leverage risk assessments conducted for other purposes (i.e., pursuant to a requirement under the EU’s General Data Protection Regulation), provided that the risk assessment contains the information that must be addressed under the CCPA regulations. Businesses subject to the CCPA should not wait until the CPPA’s first submission deadline to prepare but should begin identifying covered processing activities, building risk-assessment workflows, and documenting decision-making now. The CPPA’s new risk assessment regulations shift CCPA compliance from a notice-and-response framework toward a more proactive, documented governance model. Any preexisting processing activities are afforded a grace period, but the risk assessment must be conducted and documented no later than December 31, 2027.

GM’s $12.75 Million CCPA Settlement: California’s Record Penalty and the First Data Minimization Enforcement Action

Any sale or sharing of personal information is a covered trigger. A company executive must make the submission — this is not a staff-level task that can be delegated without accountability. The earlier CPRA amendments focused primarily on consumer-facing rights — the right to correct, the right to limit use of sensitive information, the expanded opt-out mechanisms. Then the two years arrive, and they discover that the underlying work — the inventories, the workflows, the vendor reviews, the internal governance — takes longer than they planned. The CPPA’s finalized regulations mark a sharp change in California’s privacy regime, bringing ADMT oversight, formal risk assessments and independent cybersecurity audits onto the compliance landscape.

It creates a two-year window to build a program that results in a defensible filing. The https://4equality.info/getting-down-to-basics-with CPPA will be comparing what companies file against what they appear to have been doing based on their public-facing data practices, their privacy policies, their ad-tech configurations, and other observable signals. A culture of undocumented informal risk review will not satisfy this requirement.

• Then the two years arrive, and they discover that the underlying work — the inventories, the workflows, the vendor reviews, the internal governance — takes longer than they planned.
• The agency has published guidance on the risk assessment requirements that is worth reviewing alongside the regulatory text.
• This means reviewing your data flows, vendor agreements, product features, advertising configurations, and analytics integrations.
• Automated decision-making technology (ADMT) that makes or materially influences decisions with legal or similarly significant effects on individuals triggers both a risk assessment requirement and new consumer rights obligations.
• As part of a continued series on the CCPA, this article focuses on Article 10 of the updated regulations (“Article 10”), which requires businesses to conduct and document formal risk assessments for processing activities that present a significant risk to consumers’ privacy.

• The companies that treat 2026 and 2027 as a build-out window will reach the April 1, 2028 certification confident; those that wait will almost certainly spend 2028 reconstructing evidence.
• The underlying obligation to conduct data protection assessments before high-risk processing is not — at least for companies subject to other state privacy laws that have been in effect for one to three years.
• If they don’t qualify, the data transfer is potentially a sale — requiring an assessment before continuation.
• As the regulations went into effect in January 2026, a risk assessment must be completed prior to beginning any processing.

Relying on the previous calendar year’s revenue, businesses with over $100 million in gross revenue must complete their first report by April 1, 2028; those with $ million by April 1, 2029; and those with under $50 million by April 1, 2030, and cover the preceding calendar year. Under the CCPA, ADMT means “any technology that processes personal information and uses computation to replace human decision-making or substantially replace human decision-making.” A decision is “substantially” replacing human involvement if the output is used to make a decision without meaningful human review. Businesses required to conduct a cybersecurity audit must annually certify to the CPPA that it has completed its cybersecurity audit.

Internal auditors cannot report to the executive management team member who is responsible for the business’s cybersecurity program. The auditor must also exercise independent judgment. The auditor must have specific knowledge of cybersecurity and cybersecurity audits. Audit reports and related documents must be retained for five years.

In performing the audit, auditors must operate independently and rely on their own analyses of the relevant security testing and information provided in making their assessment. Organizations face several notable compliance challenges under these requirements. Organizations that sell or share personal information, use automated decision-making or process sensitive personal information are very likely subject to these requirements. As part of a continued series https://unisto-petrostal.ru/en/sistemy-planirovaniya-resursov-predpriyatiya-erp-funkcii-i-podsistemy-erp.html on the CCPA, this article focuses on Article 10 of the updated regulations (“Article 10”), which requires businesses to conduct and document formal risk assessments for processing activities that present a significant risk to consumers’ privacy.