Treat cybersecurity audits, privacy risk assessments and automated decision-making as three connected—but separately scoped—workflows. The California Privacy Protection Agency’s package was approved on 22 September 2025 and became effective on 1 January 2026. It covers these three areas alongside other CCPA updates and insurance-related provisions. (cppa.ca.gov)
Who needs a scope assessment?
Do not infer applicability from employee count. Article 9’s audit tests include the statutory selling/sharing revenue test, or the CCPA revenue threshold combined with processing-volume thresholds of 250,000 consumers or households’ personal information, or 50,000 consumers’ sensitive personal information, in the preceding year. Have counsel apply the exact business, data and exemption provisions. (cppa.ca.gov)
The practical requirement is an applicability decision for each relevant processing activity and legal entity—not one organisation-wide “CCPA compliant” flag.
Which dates are different?
| Workstream | Timing | Buyer implication |
|---|---|---|
| Risk assessments | Compliance began on 1 January 2026; first assessment-information submissions and attestations are due 1 April 2028. | A later submission date is not permission to postpone the assessment programme. (cppa.ca.gov) |
| ADMT | Requirements begin 1 January 2027 for covered significant-decision uses. | Inventory decisions and operationalise rights before launch. (cppa.ca.gov) |
| Cybersecurity audits | First certifications fall on 1 April 2028, 1 April 2029 or 1 April 2030, according to the applicable revenue cohort. | Configure the correct cohort rather than one universal audit deadline. (cppa.ca.gov) |
For processing subject to assessment, the regulations distinguish assessment before initiating new processing from the transition for continuing pre-existing processing, whose assessments must be completed by 31 December 2027. For the earliest audit cohort—over $100 million in the specified revenue year—the first audit covers 1 January 2027 through 1 January 2028. (cppa.ca.gov)
What should the platform demonstrate?
Recommended acceptance test: give every shortlisted supplier the same synthetic business process and ask it to:
- Record why the process is—or is not—subject to each of the three workstreams.
- Separate a processing activity from the technology supporting it.
- Require assessment approval before a proposed processing change goes live.
- Preserve the previous assessment when the process changes.
- Collect evidence against the correct audit period.
- Distinguish completing an assessment, approving it, submitting information and retaining the submission receipt.
Ask for a demonstration of how the administrator changes a threshold or date without overwriting the historical decision. Price the privacy inventory, assessment workflow, consumer-request integration and audit capability separately. A bundled “California compliance” module should not substitute for that scope breakdown.
Sources cited on this page
- cppa.ca.gov ↗cppa.ca.gov
- cppa.ca.gov ↗cppa.ca.gov
- cppa.ca.gov ↗www.cppa.ca.gov