US CCPA Risk and Cyber Audits

For a covered business, risk assessments attach to listed processing activities without a separate company-size threshold. Complete one before selling or sharing personal information, processing sensitive personal information outside the narrow listed employment-administration purposes, using ADMT for a significant decision, carrying out specified extensive profiling, or processing personal information to train specified ADMT or identity technologies.

Cybersecurity audits use a different test. They apply when the business derived 50 percent or more of its annual revenue from selling or sharing consumers' personal information in the preceding calendar year. They also apply when the business met the CCPA gross-revenue threshold and processed at least 250,000 consumers' or households' personal information, or at least 50,000 consumers' sensitive personal information, in the preceding calendar year.

Privacy should own the processing inventory and assessment method; security should own cybersecurity-program evidence; product and HR owners should identify significant-decision ADMT; and legal should review scope and narrow exceptions. The cybersecurity auditor may be internal or external, but must be qualified, objective, and independent from the activities being audited.

Keep each risk-assessment report, specific purpose, minimum necessary data, sources, processing method, retention, benefits, negative impacts, safeguards, contributors, approval, update history, and CPPA submission record. For cybersecurity audits, retain the scope, criteria, evidence, tests, findings, remediation status, auditor statement, executive review, certification, and all relevant documents for at least five years.

Do not collapse the three regimes into a single 'high-risk processing' label. A sale or sharing flow triggers a risk assessment for a covered business, but the annual cybersecurity-audit test still depends on the audit thresholds. Conversely, a business may meet an audit threshold even when a particular new use does not involve ADMT.

Employment administration has a narrow sensitive-personal-information risk-assessment exception for compensation, employment authorization, benefits, legally required accommodation, and wage reporting when the data is processed solely and specifically for those purposes. It is not a general employee-data exception. Significant-decision ADMT in use before January 1, 2027 must meet Article 11 by that date. Article 11 generally requires a pre-use notice and access method; it requires an opt-out method unless an exception applies, including a qualifying human appeal process.

For covered processing started before January 1, 2026 and continuing afterward, complete and document the required risk assessment by December 31, 2027. Submit the prescribed summary information for assessments conducted in 2026 and 2027 by April 1, 2028. For later years, submit by April 1 following a year in which the business conducted or updated an assessment. The Agency or Attorney General may separately demand full reports, which must be provided within 30 calendar days.

First cybersecurity-audit reports are phased by revenue: April 1, 2028 for a qualifying business with more than $100 million in 2026 revenue; April 1, 2029 for a qualifying business with $50 million to $100 million in 2027 revenue; and April 1, 2030 for a qualifying business with less than $50 million in 2028 revenue. Each first audit covers the stated one-year period in section 7121; later qualifying audits follow the annual cycle.