Virginia’s CDPA, Colorado’s CPA, Connecticut’s CTDPA, Texas’s TDPSA, and several others all require businesses to conduct impact assessments before high-risk processing. Companies that treat 2028 as a starting point will arrive at April with assessments they haven’t conducted, for processing activities they’ve been running for two years without authorization. The April 2028 filing date is when documents change hands — not when the underlying compliance obligation begins. Most data protection assessment laws treat the document as an internal governance artifact. The California Privacy Protection Agency invited the public to attend three statewide stakeholder sessions to learn about and provide preliminary feedback on the Agency’s proposed regulations on automated decision-making technology, risk assessments, and cybersecurity audits.
Notably, the CPPA notes the goal of a risk assessment is to restrict or prohibit the “processing of https://softrop.com/7-smart-ways-to-use-hybrid-cloud-for-data-management/ personal information if the risk to the consumer’s privacy outweigh the benefits resulting from the processing.” Thus, businesses must carefully weigh whether to proceed in processing activities that present significant risk to consumers’ privacy. The new regulations also require businesses to perform privacy risk assessments if their processing of personal information presents a “significant risk” to consumers’ privacy. Importantly, only businesses that meet the specified thresholds are required to complete a cybersecurity audit. The updated regulations also elucidate requirements on performing annual cybersecurity audits for businesses whose processing of personal information presents a “significant risk” to consumers’ security. This article is part of our Actionable Guidance for Navigating the California Consumer Privacy Act series.
- The revised CCPA regulations — effective January 1, 2026 — mark a significant shift in California privacy law, moving organizations beyond disclosure-based compliance toward documented, defensible privacy governance.
- Businesses subject to the CCPA should not wait until the CPPA’s first submission deadline to prepare but should begin identifying covered processing activities, building risk-assessment workflows, and documenting decision-making now.
- The revision builds upon existing requirements and introduces new obligations for in-scope organizations, including formal risk assessments, annual cybersecurity audits and enhanced consumer rights processes related to the use of automated decision-making technologies.1
- The new regulations also require businesses to perform privacy risk assessments if their processing of personal information presents a “significant risk” to consumers’ privacy.
- The risk assessment must (1) involve relevant stakeholders involved in the specific processing; and (2) result in a report maintained by the business.
Similar to the opt-out requirements for the selling or sharing data, businesses must offer at least two ways for consumers to submit opt-out requests and at least one option must reflect the primary way the business interacts with consumers. The companies that treat 2026 and 2027 as a build-out window will reach the April 1, 2028 certification confident; those that wait will almost certainly spend 2028 reconstructing evidence. The ADMT consumer notice and opt-out requirements phase in fully on January 1, 2027, giving companies with AI-driven decision systems one year to build the governance infrastructure. Many companies will have existing vendor relationships that were never assessed. Risk assessments, cybersecurity audits, and in https://ymlp280.net/2024/12/12/ some cases formal AI governance programs are now mandatory processes, not optional best practices.
Certification and Reporting
That is an existing compliance gap — independent of California’s new filing requirement — that has been accumulating for up to three years. Most companies subject to those laws have not completed the assessments the laws required. If an analytics or advertising vendor cannot represent that it will use your data exclusively within the scope of the direct business relationship and will not combine it with data from other sources, it likely does not qualify as a “service provider” under the CCPA. Under the CPPA regulations, businesses must submit completed assessments to the California Privacy Protection Agency. The business must submit a certification of completion by the auditor to the CPPA each year that the business is required to conduct a cyber audit. While these requirements are phased in over several years, they represent a significant expansion of the CCPA’s reach and will require businesses to undertake new documentation, governance and consumer-facing processes.
When Do the Rules Apply?
As the regulations went into effect in January 2026, a risk assessment must be completed prior to beginning any processing. While assessments done in 2026 and 2027 must be submitted by April 1, 2028, the regulations contemplate that businesses will complete necessary risk assessments now in 2026. New California Privacy Protection Agency (CPPA) regulations require businesses subject to the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act, to conduct and document risk assessments for certain high-risk processing activities. This article is prepared for the general information of interested persons. White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities. In turn, the business must make available to the auditor all requested relevant information and must make a good faith effort to truthfully disclose all relevant facts.
GM’s $12.75 Million CCPA Settlement: California’s Record Penalty and the First Data Minimization Enforcement Action
Companies that build intake, documentation, approval, and vendor-management processes now will be better positioned to respond efficiently to CPPA or Attorney General requests. If a material change occurs that creates new negative impacts, increases the magnitude or likelihood of previously identified impacts, or diminishes the effectiveness of existing safeguards, the business must update the risk assessment within 45 calendar days of the material change. Therefore, it is important for businesses to understand when a risk assessment is triggered and how best to prepare and implement practices to address these requirements. Importantly, a business may utilize cybersecurity reports prepared for another purpose if they comply with all regulatory requirements. The report must include descriptions and assessments of all specific cybersecurity controls used, such as encryption, multi-factor authentication, access controls, hardware/software configurations, vulnerability scans, network monitoring, and cybersecurity training. The regulations require that each covered business conduct an independent cybersecurity audit that results in a report.
- For new vendor relationships entered into in 2026, the assessment cannot be deferred.
- By April 1 of each year, businesses must submit a certification to the CPPA that it has completed its cybersecurity audit which must be signed by a member of the business’s executive management team attesting to responsibility for its content and to the report’s accuracy.
- Precise geolocation is frequently collected without being treated as sensitive.
- Employment decisions, credit decisions, housing, education, healthcare — any algorithmic system that contributes to these outcomes falls within scope.
- Most companies subject to those laws have not completed the assessments the laws required.
