Use this working template before a CCPA-covered business starts any processing listed in section 7150, including sale or sharing, sensitive-data processing, covered profiling, and specified ADMT or AI uses.
It maps the final CPPA regulations effective January 1, 2026 to the report fields, approval, update, retention, and Agency-submission records a business must maintain.
Structured answer sets in this page tree.
Cited legal and guidance references.
A is the documented CPPA analysis that a CCPA-covered business must complete before starting any processing listed in section 7150. The listed activities include selling or sharing personal information, processing sensitive personal information, using ADMT for a significant decision, specified profiling, and training ADMT or identity, biological-identification, or profiling technology with personal information. Covered processing that began before January 1, 2026 and continues afterward must be assessed by December 31, 2027. Review each assessment at least once every three years and update it within 45 calendar days after a material change.
Use this template only after intake identifies a section 7150 trigger. Complete and approve it before new covered processing starts. One report may cover a comparable set of similar activities only when they present similar privacy risks. A report prepared for another law may be reused only if it contains every section 7152 item or is paired with the missing California information.
The report must state a specific purpose; the personal information and minimum data necessary; collection, use, disclosure, retention, consumer interaction, scale, notices, and recipients; benefits; negative privacy impacts and their causes; safeguards; the launch decision; contributors; and approval by someone authorized to help decide whether processing starts. For covered ADMT used for a significant decision, it must also explain the logic, assumptions or limits, output, and how the output affects the decision. The regulatory goal is to restrict or prohibit the processing when privacy risks outweigh the benefits.
The sensitive-personal-information trigger has a narrow employment exception. No assessment is required when employee or independent-contractor sensitive information is processed solely and specifically for compensation payments, employment authorization, benefits, legally required accommodation, or wage reporting. Other sensitive-information processing remains subject to section 7150.
The business's assessment owner should maintain this record with the product, privacy, security, data, and operational employees who know how the processing works. Each field supports the section 7152 report and the later summary submission. This page is Sorena's implementation aid, not a CPPA form, safe harbor, or prescribed wording.
Review each assessment at least once every three years, not annually. Update it as soon as feasible and no later than 45 calendar days after a material change creates a new negative impact, increases the magnitude or likelihood of an identified impact, or weakens a safeguard. Keep original and updated versions for as long as the processing continues or for five years after completion, whichever is later.
This US CPRA guide turns CPRA Risk Assessment Template into owners, evidence requests, review checkpoints, and reusable operating records in Sorena.
Turn CPRA Risk Assessment Template into scoped questions, evidence fields, and review tasks.
Use Research Copilot to answer follow-up questions with cited source material.
Review scope, evidence, owners, and the next compliance actions with Sorena.
"On March 29, 2023, the Office of Administrative Law approved the California Privacy Protection Agency’s regulations and filed"
"The CPRA amended the CCPA by adding additional consumer privacy rights and obligations for businesses"
"Submission of Risk Assessments to the Agency"
"guidance on analyzing assessment results"
"This publication provides a catalog of security and privacy controls for information systems and organizations"