Cybersecurity Policy Report, Rules on Risk Assessments, Cybersecurity Audits Finalized by CPPA, (Jul 30, 2025)
By Tony Foley
Rules finalized by the California Privacy Protection Agency (CPPA) last week included provisions related to the conduct of risk assessments and required cybersecurity audit procedures as required by the California Consumer Privacy Act (CCPA).
As previously reported, the CPPA faced a stream of criticism after its final approval of rules implementing CPPA provisions related to automated decision-making technologies (ADMT) from consumer groups alleging that they watered down consumer protections after intense lobbying by Big Tech companies (CPR, July 25). Less attention was paid, however, to the other finalized rules, as outlined below.
Risk assessments. Under the final rules (article 10, secs. 7150-7157), businesses will be required to conduct a risk assessment for a variety of specified processing activities, including the sale or sharing of personal information, processing of sensitive data, using ADMT to make a “significant decision” concerning a consumer, using ADMT to infer or extrapolate characteristics of consumers (like intelligence, aptitude, economic or health situation, etc.) in specific educational and employment contexts, and processing personal information of consumers that a business intends to use to train an ADMT used to make significant decisions. The rules also provide examples of activities for which businesses will need to conduct a risk assessment.
The risk assessment requirements in the approved rules will apply to processing activities initiated after the Office of Administrative Law finalizes the effective date of the regulation, and any such assessments must be conducted and documented no later than Dec. 31, 2027.
Cybersecurity audits. The final rules specify in article 9 (secs. 7120-7124) that businesses whose processing presents a significant risk to consumers’ security must complete a cybersecurity audit. The rules specify the businesses subject to these requirements based on the existence of a significant risk to consumer’s security, including businesses that derive 50% or more of annual revenues from selling or sharing consumers’ personal information, or businesses that have gross revenues in excess of $25 million in the preceding calendar year and that process the personal information of 250,000 or more consumers or process the sensitive personal information of 50,000 or more consumers.
Businesses will be required to fulfill their audit obligations and file their first audit report by April 1, 2030, although the audit requirements will be phased in, as follows:
April 1, 2028, for businesses with annual gross revenue of more than $100 million as of Jan. 1, 2027;
April 1, 2029, for businesses with annual gross revenue of between $50 million and $100 million as of Jan. 1, 2028; and
April 1, 2030, for any businesses whose annual gross revenues are in excess of $25 million but less than $50 million.
The remainder of the provisions of article 9 specify the scope of an audit and the contents of the report required to be filed with the CPPA, which include an evaluation of more than 18 components of the businesses’ cybersecurity program, such as authentication and encryption, account management and access controls, software and hardware configuration, and network monitoring, among many others. Each year, businesses will be required to certify that they have completed the audit.
News: StateLegislation DataPrivacy DataSecurity CCPA