Tracker record · California · Final rule
California privacy assessment, audit, and ADMT regulations
California Privacy Protection Agency regulations on risk assessments, cybersecurity audits, and automated decisionmaking technology (ADMT) under the CCPA. Risk-assessment completion, submission of assessments to the agency, cybersecurity audit reporting, and ADMT compliance are distinct obligations with distinct timelines.
Status
- Legal status
- In effect; staged compliance dates (Regulations effective January 1, 2026. Risk assessments: required before beginning high-risk processing; completion due by December 31, 2027 for processing already underway; first submission of assessment summaries and attestations to the CPPA due April 1, 2028. Cybersecurity audits: under 11 C.C.R. 7121, the first audit report must be completed by April 1, 2028 (annual gross revenue over $100 million), April 1, 2029 ($50-100 million), or April 1, 2030 (under $50 million). Under 11 C.C.R. 7124, the business must separately submit a written certification of audit completion to the CPPA no later than April 1 following any year it is required to complete an audit. ADMT: under 11 C.C.R. 7200, a business using covered ADMT for a significant decision before January 1, 2027 must comply by January 1, 2027; a business using covered ADMT for a significant decision on or after January 1, 2027 must comply whenever it uses the technology.)
- Allegation or finding
- Operative law
- Applicability
- Risk assessments: businesses whose processing presents significant risk to consumers' privacy (11 C.C.R. 7150), including selling or sharing personal information, processing sensitive personal information, and using ADMT for a significant decision. Cybersecurity audits: businesses whose processing presents significant risk to consumers' security under the separate thresholds of 11 C.C.R. 7120. ADMT: businesses using ADMT for a covered significant decision (11 C.C.R. 7200). Audit and assessment obligations are determined separately; a business subject to one is not automatically subject to the other.
- Enforceability
- Binding on parties within scope
- Law checked through
- October 12, 2026
- Citation
- 11 C.C.R. 7000 et seq.
- Source
- California Privacy Protection Agency, CCPA updates rulemaking (approved by the Office of Administrative Law September 22, 2025); Hunton