While the new regulations give businesses subject to the CCPA time to implement its requirements, businesses must assess and make preparations to implement their compliance obligations. For example, if a business is subject to a National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 audit which complies with all requirements, the business could submit that as its yearly report. The Cybersecurity Audit rule is a new requirement for covered businesses to conduct audits by a qualified independent professional and submit yearly certifications to the CPPA.
Organizations with specific compliance questions should consult qualified privacy counsel. This article is for informational purposes only and does not constitute legal advice. The question in 2026 is not whether your organization will eventually need to address these requirements. The agency has published guidance on the risk assessment requirements that is worth reviewing alongside the regulatory text.
One exception is the alternative decision-making process where the business offers an appeal process that is conducted by a human reviewer with the authority to overturn the decision. There are limited exceptions to the opt-out right. The opt-out methods must be easy to use, require minimal steps, and must not hide the opt-out behind generic cookie banners. Businesses must provide consumers the right to opt out of ADMT used for Significant Decisions. The Pre-Use Notice can be incorporated into the business’s CCPA notice at collection and can also be consolidated for multiple ADMTs used for a single or multiple purposes.2. Businesses must also amend their service provider agreements to require their service providers https://workingholiday365.com/website-development-and-promotion-for-construction-companies-and-developers.html to assist them in completing their cybersecurity audits, risk assessments, and complying with the new ADMT requirements.
Final rulemaking documents
For risk assessments conducted https://cottageindesign.com/neoprofit-is-the-leading-platform-for-automated-cryptocurrency-trading.html in 2026 and 2027, businesses are required to submit information regarding the assessment — but not the assessment itself — to the CPPA by April 1, 2028. Businesses must retain assessments for the duration of processing or five years after completion. “Significant decisions” includes decisions that affect finances, housing, education, employment or health care, but not advertising (which was included in previous drafts of the regulations). The regulations impose requirements on business that use ADMT to make a “significant decision” concerning a consumer. In short, businesses should treat the CPPA’s risk assessment rules as an operational governance requirement, not merely a filing obligation.
Compliance Requirements
- That is an existing compliance gap — independent of California’s new filing requirement — that has been accumulating for up to three years.
- Businesses must retain assessments for the duration of processing or five years after completion.
- While the new regulations give businesses subject to the CCPA time to implement its requirements, businesses must assess and make preparations to implement their compliance obligations.
- That distinction matters for how seriously organizations take the underlying work.
- Internal auditors cannot report to the executive management team member who is responsible for the business’s cybersecurity program.
Many companies will discover they are in-scope for sensitive data processing when they actually trace their data flows. Precise geolocation is frequently collected without being treated as sensitive. Companies running retargeting campaigns, lookalike audience programs, or behavioral targeting through any third-party demand-side platform should be examining whether those arrangements have been assessed. The regulations identify specific processing activities that require a risk assessment. That distinction matters for how seriously organizations take the underlying work.
Identify who that will be, brief them on the obligation, and begin tracking which assessments will be submitted and when. Assessments must be producible within 30 days of a regulatory request. Organizations without this workflow will repeatedly face the choice between delaying launches and skipping assessments they’re legally required to complete. This requires a workflow — a formal intake and review process that routes new initiatives through privacy assessment before they go live. Colorado’s CPA had equivalent requirements effective July 1, 2023.
GM’s $12.75 Million CCPA Settlement: California’s Record Penalty and the First Data Minimization Enforcement Action
Assessments that other states treat as internal governance artifacts have, in California, become public filings. That 30-day production obligation means an assessment that hasn’t been documented — that exists only as informal internal discussions — will not satisfy the requirement when an enforcement inquiry arrives. The CPPA or the California Attorney General can also request a full copy of any risk assessment at any time, and businesses must produce it within 30 days of that request. What they do not require is that those assessments be submitted to anyone.
TIMING AND RETENTION REQUIREMENTS
The Audit requirement does not apply to all businesses subject to the CCPA, but only those that meet certain thresholds. For assessments conducted after 2027, the submission is due by April 1 of the following year. For assessments conducted in 2026 and 2027, the submission is due by April 1, 2028. Risk assessments must involve relevant stakeholders whose duties include the processing activity that necessitated the risk assessment. Other narrow exceptions apply to certain hiring, admissions, and work allocation decisions, but only when the ADMT is used solely for assessing the consumer’s ability to perform and the ADMT demonstrably works for its purpose and does not unlawfully discriminate.3.
The combination of a 45-day material-change trigger, a three-year baseline refresh, an annual certification and the parallel cybersecurity audit obligations make the cost of an ad-hoc approach significantly higher than the cost of standing up a sustained program. For organizations operating in California, the practical effect is that risk assessments become a continuous program rather than a project. The initial submission is due April 1, 2028, covering risk assessments conducted in 2026 and 2027, with annual submissions required each year thereafter. The CCPA regulations establish a comprehensive risk assessment framework that requires businesses to evaluate whether privacy risks to consumers outweigh the benefits of processing, and to document that analysis in formal risk assessment reports before initiating covered processing activities. Article 10 requires organizations to conduct risk assessments before initiating processing activities that present significant risk to consumer privacy.