CPPA Finalizes CCPA Regulations on Automated Decision-Making Technology, Risk Assessments and Cybersecurity Audits

Below is a high-level overview of the approved rules and next steps, and activity on the ongoing Delete Request and Opt-Out Platform (DROP) rulemaking. Our Privacy, Cyber & Data Strategy Team offers comprehensive resources and expert guidance to help your organization prepare for and respond to ransomware incidents. Businesses should ensure that their contracts with service providers and contractors include provisions requiring this cooperation. Also, businesses should establish a centralized, indexed repository for all risk assessments now, and consider how to structure assessments to preserve attorney-client privilege while still meeting the substantive documentation requirements of Section 7152. However, the CPPA or Attorney General’s Office may require full risk assessment reports at any time, and the business must produce them within 30 calendar days of the request.

Businesses whose processing presents significant risk to consumers’ security must complete an annual cybersecurity audit. Engaging auditors, mapping data flows, documenting processing activities, and structuring assessments for privilege all take substantial lead time. For additional background on these regulations, please refer to our prior coverage here.

California's new audit and privacy risk assessment regulations under the California Consumer Privacy Act will create new compliance obligations for many businesses. It is not, and does not attempt to be, comprehensive in nature. White & Case means the international legal practice comprising White & Case LLP, a New York State registered limited liability partnership, White & Case LLP, a limited liability partnership incorporated under English law and all other affiliated partnerships, companies and entities. Finally, it is important to note that California’s CCPA regulations will continue to be assessed and subject to further modification proposals from the CPPA. While the new regulations give businesses subject to the CCPA time to implement its requirements, businesses must assess and make preparations to implement their compliance obligations.

• To fulfill its duties, CalPrivacy is authorized to adopt and amend regulations through the Administrative Procedures Act rulemaking process under both laws.
• The California Privacy Protection Agency (CPPA) board unanimously voted on July 24, 2025 to finalize a package of regulations related to automated decision-making technology (ADMT), cybersecurity audits, and risk assessments.
• Companies must demonstrate that they have operationalized such policies via technical and organizational safeguards, and that those safeguards operate effectively and can withstand independent audit.
• By acting now to inventory ADMT, institutionalize risk assessments, and identify cybersecurity audit partners, businesses can mitigate regulatory risk, build consumer trust, and ultimately strengthen the resiliency of their data ecosystems.
• Although enforcement will be phased in between 2027 and 2030, covered businesses should begin preparing now to inventory ADMT use cases, identify a cybersecurity audit partner, and develop risk assessment processes.

When Do the Rules Apply?

The report must include descriptions and assessments of all specific cybersecurity controls used, such as encryption, multi-factor authentication, access controls, hardware/software configurations, vulnerability scans, network monitoring, and cybersecurity training. The cybersecurity audit covers generally the business’s cybersecurity program, protection of personal information, and protection against unauthorized access. In turn, the business must make available to the auditor all requested relevant information and must make a good faith effort to truthfully disclose all relevant facts. Internal auditors cannot report to the executive management team member who is responsible for the business’s cybersecurity program. The auditor must also exercise independent judgment. The auditor must have specific knowledge of cybersecurity and cybersecurity audits.

Employees whose job duties include the processing activity under assessment must be included in the risk assessment process. Businesses should approach this as a substantive analytical exercise and not a checkbox because the CPPA can demand the https://alcitynews.com/hide-expert-vpn-your-gateway-to-secure-and-private-internet-browsing.html full report on 30 days’ notice, and the assessment must demonstrate genuine weighing of risks against benefits. Unlike the cybersecurity audit, which is triggered by business revenue and data volume thresholds, the risk assessment obligation is triggered by the nature of the processing activity. This includes making relevant information available to the auditor and refraining from misrepresenting facts.

Philippines – GPPB Confirms Beneficial Ownership Disclosures Are Mandatory

• Additionally, the CPPA revised certain existing regulations to the California Consumer Privacy Act (CCPA).
• All audits must be completed annually thereafter, and an annual certification of completion must be submitted to the CCPA by April 1 following the reporting period.
• In the meantime, businesses may want to evaluate application and start developing processes to ensure compliance with these new regulations.
• The regulations state that human involvement means the human reviewer (1) knows how to interpret the technology’s output, (2) affirmatively reviews the technology’s output to make a decision, and (3) has actual authority to make or change the technology’s decision based on his or her own analysis.
• The long-awaited regulations establish additional requirements on certain businesses operating in California, and are now pending final review by the Office of Administrative Law.
• The rules now head to the California Office of Administrative Law for approval before taking effect.

The certification must be completed by an executive management team member who is directly responsible for the business’s cybersecurity audit compliance, has sufficient knowledge of the audit to provide accurate information, and has authority to submit the certification on behalf of the business. The regulations establish a phased timeline for the first cybersecurity audit based on annual gross revenue, as summarized in the Key Compliance Deadlines table above. Businesses may assess additional components and https://www.softforsale.com/67244/buy-pakeysoft-zip-password-recovery.html may use an audit prepared for another purpose (e.g., a NIST CSF 2.0 assessment) if it satisfies the Article 9 requirements, either alone or through supplementation. Businesses should begin the auditor selection and engagement process now because qualified auditors with cybersecurity expertise may be in high demand as deadlines approach. The audit must be performed by a qualified, objective, independent professional using accepted procedures and standards.