US CCPA Risk and Cyber Audits

A business must conduct a risk assessment before selling or sharing personal information; processing sensitive personal information; using automated decisionmaking technology (ADMT) for a significant decision; carrying out specified systematic-observation or sensitive-location profiling; or processing personal information to train specified ADMT, facial-recognition, emotion-recognition, identity-verification, or physical or biological identification or profiling technology. The sensitive-information exception is limited to employees or independent contractors and processing solely and specifically to administer compensation payments, determine and store employment authorization, administer employment benefits, provide legally required reasonable accommodation, or perform legally required wage reporting. Other sensitive-information processing remains subject to the assessment requirements.

A cybersecurity audit is required if the business derived at least 50 percent of its annual revenue from selling or sharing consumers' personal information in the preceding year. It is also required when the business meets the CCPA revenue threshold and, in the preceding year, processed either the personal information of at least 250,000 consumers or households or the sensitive personal information of at least 50,000 consumers.

The first audit report is due April 1, 2028 for a qualifying business with more than $100 million in 2026 annual gross revenue; April 1, 2029 for a qualifying business with 2027 revenue between $50 million and $100 million; or April 1, 2030 for a qualifying business with 2028 revenue below $50 million. The regulations specify a one-year audit period for each phase. After April 1, 2030, a business that meets section 7120 on January 1 based on the preceding year must audit the next 12 months and complete its report by April 1 of the following year.

Processing started before January 1, 2026 and continuing after that date must have its risk assessment documented by December 31, 2027. Information for assessments conducted in 2026 and 2027 is due to the Agency by April 1, 2028; later submissions are due by April 1 following a year in which assessments were conducted. The routine submission is specified information and an executive attestation, not the full assessment report.

For a cybersecurity audit, keep the scope, criteria, evidence examined, testing and sampling, findings, gaps, remediation plan and dates, auditor qualifications, signed auditor statement, and any required breach-notification material. The business and auditor must retain all documents relevant to each audit for at least five years after completion.

For a risk assessment, preserve the specific processing purpose, data categories and minimum necessary data, sources, retention, affected consumers, technology and participants, benefits, negative impacts, safeguards, residual risks, and the decision-maker's name and position. Keep original and updated versions for as long as the processing continues or five years after completion, whichever is later.

The Agency receives a cybersecurity-audit completion certification, not the full audit report as the routine annual filing. Risk-assessment submissions contain the information listed in section 7157, including counts, categories, and an executive attestation; the Agency or Attorney General may separately demand the assessment reports, which must then be provided within 30 calendar days.

Do not combine the two threshold tests. High-risk privacy processing can require a risk assessment even when the business does not meet the cybersecurity-audit thresholds. Conversely, a business subject to annual audits must still test each activity separately under section 7150.

The auditor may be internal or external, but must use objective and impartial judgment, be free to report findings without influence, and not rely primarily on management assertions. A risk assessment must be reviewed at least once every three years and updated as soon as feasibly possible, no later than 45 calendar days after a material change that creates or increases negative impacts or weakens safeguards.