Use this template only after intake identifies a section 7150 trigger. Complete and approve it before new covered processing starts. One report may cover a comparable set of similar activities only when they present similar privacy risks. A report prepared for another law may be reused only if it contains every section 7152 item or is paired with the missing California information.
The report must state a specific purpose; the personal information and minimum data necessary; collection, use, disclosure, retention, consumer interaction, scale, notices, and recipients; benefits; negative privacy impacts and their causes; safeguards; the launch decision; contributors; and approval by someone authorized to help decide whether processing starts. For covered ADMT used for a significant decision, it must also explain the logic, assumptions or limits, output, and how the output affects the decision. The regulatory goal is to restrict or prohibit the processing when privacy risks outweigh the benefits.
The sensitive-personal-information trigger has a narrow employment exception. No assessment is required when employee or independent-contractor sensitive information is processed solely and specifically for compensation payments, employment authorization, benefits, legally required accommodation, or wage reporting. Other sensitive-information processing remains subject to section 7150.