US CPRA Deadlines and Compliance Calendar

For a request to delete, correct, know, access ADMT, or appeal an ADMT decision, confirm receipt within 10 business days. Respond within 45 calendar days from the day the business receives the request; verification time does not pause that clock. If necessary, the business may take one additional 45-day period, for no more than 90 calendar days total, after notifying the consumer and explaining the delay.

For a request to opt out of sale or sharing, stop the sale or sharing as soon as feasibly possible and no later than 15 business days after receipt. For a request to limit use or disclosure of sensitive personal information, stop the covered use or disclosure on the same 15-business-day schedule. The regulations also require notices or instructions to relevant third parties, service providers, or contractors in the circumstances described in Sections 7026 and 7027.

Record the receipt timestamp, request type, verification status where verification is permitted, response due date, extension notice, decision, and downstream instructions. Do not make identity verification a condition of processing an opt-out of sale or sharing.

The cybersecurity-audit, risk-assessment, and automated decisionmaking technology regulations took effect January 1, 2026. Each duty still applies only when its cited trigger is met.

A business must assess a processing activity covered by Section 7150 before starting it. Covered activities include selling or sharing personal information, most processing of sensitive personal information, specified ADMT and automated profiling uses, and processing intended to train specified technologies. A covered activity that began before January 1, 2026 and continued after that date must have a documented risk assessment by December 31, 2027. Assessments must be reviewed at least every three years and updated within 45 calendar days after a material change. Information for assessments conducted in 2026 and 2027 is first due to the Agency by April 1, 2028; later annual submissions are due by April 1 after the year in which the assessments were conducted.

A business using ADMT to make a significant decision before January 1, 2027 must comply with Article 11 by January 1, 2027. A business starting such use on or after that date must comply whenever it uses the ADMT for a significant decision.

Cybersecurity audits apply only when Section 7120's significant-risk test is met. First audit reports are due April 1, 2028 for businesses with more than $100 million in 2026 gross revenue; April 1, 2029 for businesses with $50 million to $100 million in 2027 gross revenue; and April 1, 2030 for businesses with less than $50 million in 2028 gross revenue. Revenue sets the phase-in date, but the business must also meet Section 7120's processing criteria.

July 1 request-metrics disclosure applies only to a business that knows or reasonably should know that, alone or in combination, it buys, receives for commercial purposes, sells, shares, or otherwise makes available for commercial purposes the personal information of 10 million or more consumers in a calendar year. The business must compile the prior year's request counts and response-time metrics and disclose them by July 1 in its privacy policy or on a linked webpage.

After the first cybersecurity-audit cycle, a business that meets Section 7120 for the preceding year must complete an audit covering the next 12 months and finish the report by April 1 of the following year. It must submit the audit-completion certification by April 1 following each year for which an audit was required.

Risk assessments require event-driven and recurring review: before new covered processing, at least once every three years, and within 45 calendar days after a material change. Retain original and updated assessments while the processing continues or for five years after completion of the assessment, whichever is later.

The Delete Act applies to a business that meets the statute's data-broker definition, subject to its exclusions. A covered data broker must register by January 31 following each year in which it met that definition and disclose prior-year request metrics on its website by July 1. The same metrics are reported with the next annual registration.

DROP opened for California residents on January 1, 2026. Starting August 1, 2026, data brokers must access DROP at least once every 45 days and process deletion requests under the statutory schedule; the state explains to consumers that brokers must delete matched data within 90 days. These are Delete Act duties, not general deadlines for every CCPA-covered business.