CCPA Updates, Cybersecurity Audits, Risk Assessments, Automated Decisionmaking Technology ADMT, and Insurance Regulations privacy.ca.gov

In performing the audit, auditors must operate independently and rely on their own analyses of the relevant security testing and information provided in making their assessment. Organizations face several notable compliance challenges under these requirements. Organizations that sell or share personal information, use automated decision-making or process sensitive personal information are very likely subject to these requirements. As part of a continued series on the CCPA, this article focuses on Article 10 of the updated regulations (“Article 10”), which requires businesses to conduct and document formal risk assessments for processing activities that present a significant risk to consumers’ privacy.

That is an existing compliance gap — independent of California’s new filing requirement — that has been accumulating for up to three years. Most companies subject to those laws have not completed the assessments the laws required. If an analytics or advertising vendor https://101amazingcoffee.com/terms-and-conditions/ cannot represent that it will use your data exclusively within the scope of the direct business relationship and will not combine it with data from other sources, it likely does not qualify as a “service provider” under the CCPA. Under the CPPA regulations, businesses must submit completed assessments to the California Privacy Protection Agency. The business must submit a certification of completion by the auditor to the CPPA each year that the business is required to conduct a cyber audit. While these requirements are phased in over several years, they represent a significant expansion of the CCPA’s reach and will require businesses to undertake new documentation, governance and consumer-facing processes.

It is that multi-state assessment obligations are already overdue for many organizations, and California’s filing requirement creates both the incentive and the accountability structure to close those gaps. Companies that build a risk assessment program to comply with California’s requirements in 2026 and 2027 can use that same program to retroactively document the assessments other states have been requiring since 2023. The introduction of California’s more visible and more enforceable regime creates the opportunity to address it systematically. The operational implication is that risk assessments under the CPPA regulations cannot be completed in isolation by a privacy attorney drafting a template.

• The Pre-Use Notice can be incorporated into the business’s CCPA notice at collection and can also be consolidated for multiple ADMTs used for a single or multiple purposes.2.
• The Cybersecurity Audit rule is a new requirement for covered businesses to conduct audits by a qualified independent professional and submit yearly certifications to the CPPA.
• For any new processing activity, vendor relationship, product feature, or advertising configuration beginning in 2026, the assessment must happen first.
• The auditor must have specific knowledge of cybersecurity and cybersecurity audits.
• If an analytics or advertising vendor cannot represent that it will use your data exclusively within the scope of the direct business relationship and will not combine it with data from other sources, it likely does not qualify as a “service provider” under the CCPA.

What is ADMT

The revision builds upon existing requirements and introduces new obligations for in-scope organizations, including formal risk assessments, annual cybersecurity audits and enhanced consumer rights processes related to the use of automated decision-making technologies.1 By April 1 of each year, businesses must submit a certification to the CPPA that it has completed its cybersecurity audit which must be signed by a member of the business’s executive management team attesting to responsibility for its content and to the report’s accuracy. Organizations must submit specific information to the CPPA including the number of risk assessments conducted or updated during the covered period, the categories of personal information included in those assessments and a written certification under penalty of perjury attesting to completion and accuracy. For each third-party vendor that receives personal information, review whether the contractual relationship and the vendor’s actual data practices qualify it as a service provider under the CCPA. If it doesn’t qualify, the relationship may constitute a sale or sharing of personal information — which triggers an assessment requirement before you onboard the vendor. Risk assessments must also be completed before initiating the processing, reviewed and updated at least every three years or sooner if material changes occur (within 45 days), and retained for as long as the processing continues or for five years after completing the assessment.

Internal auditors cannot report to the executive management team member who is responsible for the business’s cybersecurity program. The auditor must also exercise independent judgment. The auditor must have specific knowledge of cybersecurity and cybersecurity audits. Audit reports and related documents must be retained for five years.

Any sale or sharing of personal information is a covered trigger. A company executive must make the submission — this is not a staff-level task that can be delegated without accountability. The earlier CPRA amendments focused primarily on consumer-facing rights — the right to correct, the right to limit use of sensitive information, the expanded opt-out mechanisms. Then the two years arrive, and they discover that the underlying work — the inventories, the workflows, the vendor reviews, the internal governance — takes longer than they planned. The CPPA’s finalized regulations mark a sharp change in California’s privacy regime, bringing ADMT oversight, formal risk assessments and independent cybersecurity audits onto the compliance landscape.

Relying on the previous calendar year’s revenue, businesses with over $100 million in gross revenue must complete their first report by April 1, 2028; those with $ million by April 1, 2029; and those with under $50 million by April 1, 2030, and cover the preceding calendar year. Under the CCPA, ADMT means “any technology that processes personal information and uses computation to replace human decision-making or substantially replace human decision-making.” A decision is “substantially” replacing human involvement if the output is used to make a decision without meaningful human review. Businesses required to conduct a cybersecurity audit must annually certify to the CPPA that it has completed its cybersecurity audit.

Companies that build intake, documentation, approval, and vendor-management processes now will be better positioned to respond efficiently to CPPA or Attorney General requests. If a material change occurs that creates new negative impacts, increases the magnitude or likelihood of previously identified impacts, or diminishes the effectiveness of existing safeguards, the business must update the risk assessment within 45 calendar days of the material change. Therefore, it is important for businesses to understand when a risk assessment is triggered and how best to prepare and implement practices to address these requirements. Importantly, a business may utilize cybersecurity reports prepared for another purpose if they comply with all regulatory requirements. The report must include descriptions and assessments of all specific cybersecurity controls used, such as encryption, multi-factor authentication, access controls, hardware/software configurations, vulnerability scans, network monitoring, and cybersecurity training. The regulations require that each covered business conduct an independent cybersecurity audit that results in a report.

Virginia’s CDPA, Colorado’s CPA, Connecticut’s CTDPA, Texas’s TDPSA, and several others all require businesses to conduct impact assessments before high-risk processing. Companies that treat 2028 as a starting point will arrive at April with assessments they haven’t conducted, for processing activities they’ve been running for two years without authorization. The April 2028 filing date is when documents change hands — not when the underlying compliance obligation begins. Most data protection assessment laws treat the document as an internal governance artifact. The California Privacy Protection Agency invited the public to attend three statewide stakeholder sessions to learn about and provide preliminary feedback on the Agency’s proposed regulations on automated decision-making technology, risk assessments, and cybersecurity audits.

As the regulations went into effect in January 2026, a risk assessment must be completed prior to beginning any processing. While assessments done in 2026 and 2027 must be submitted by April 1, 2028, the regulations contemplate that businesses will complete necessary risk assessments now in 2026. New California Privacy Protection Agency (CPPA) regulations require businesses subject to the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act, to conduct and document risk assessments for certain high-risk processing activities. This article is prepared for the general information of interested persons. White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities. In turn, the business http://lacasitaroja.info/page/3/ must make available to the auditor all requested relevant information and must make a good faith effort to truthfully disclose all relevant facts.