Remindash
LawActiveCal. Civ. Code § 1798.100 et seq.

California Consumer Privacy Act of 2018

California privacy compliance obligations under the CCPA as amended and its 2026 implementing regulations, including privacy notices and rights, data security, vendor controls, cybersecurity audits, risk assessments and automated decisionmaking technology.

CaliforniaCalifornia Privacy Protection Agency (CalPrivacy/CPPA)
Data ProtectionCybersecurityPrivacyComplianceFinancial ServicesTechnologyHealthcare

Overview

California privacy compliance obligations under the CCPA as amended and its 2026 implementing regulations, including privacy notices and rights, data security, vendor controls, cybersecurity audits, risk assessments and automated decisionmaking technology.

California Consumer Privacy Act of 2018 (Cal. Civ. Code §§1798.100 et seq.), including amendments effective in the statute compilation as of January 1, 2026. The CCPA applies to defined for-profit businesses doing business in California and meeting one or more revenue, data-volume or sales/sharing-revenue tests, plus certain affiliates, joint ventures and voluntary participants. Implementing regulations effective January 1, 2026 clarify consumer rights, request mechanics, risk assessments, phased cybersecurity audit reporting and automated decisionmaking. Some duties are delayed: qualifying ADMT duties begin January 1, 2027; risk assessment reporting and cybersecurity audits follow transitional timelines. The CPRA amended the CCPA; it is not represented as a second independent policy.

Obligations

Requirements identified from this policy that may need to be tracked by your organization.

10 identified

10 identified obligations

  • Update required privacy disclosures at least every 12 months

    Publish the required consumer rights and information-practice disclosures in online/privacy materials, updating them at least once every 12 months. Imported research notes (check before approving): • Duty holder: regulated entity (Business subject to the CCPA) • Timing in the source: "at least once every 12 months"

    Policy reviewAnnuallyat least once every 12 months — exact deadline not calculated

    Source: 1798.130(a)(5) · 1798.130(a)(5) · page 14Suggested owner: Privacy Officer

    View detailsTrack obligation

  • Publish large-business request metrics by July 1 annually

    Disclose required prior-year consumer rights metrics by July 1 each calendar year in privacy policy or linked webpage. Imported research notes (check before approving): • Duty holder: regulated entity (Business subject to the CCPA) • Timing in the source: "by July 1 of every calendar year"

    ReportingAnnuallyEvery 1 July

    Source: § 7102(a)(2) · § 7102(a)(2) · page 74Suggested owner: Privacy Officer

    View detailsTrack obligation

  • Complete first qualifying cybersecurity audit for >$100m cohort

    If subject to annual cybersecurity audit and 2026 gross revenue exceeded $100m as measured Jan 1 2027, complete first report by April 1 2028 covering Jan 1 2027–Jan 1 2028. Imported research notes (check before approving): • Duty holder: regulated entity (Business subject to the CCPA) • Timing in the source: "April 1, 2028"

    AuditOne-time1 April 2028

    Source: § 7121(a)(1) · § 7121(a)(1) · page 75Suggested owner: Information Security

    View detailsTrack obligation

  • Complete first cybersecurity audit for $50m–$100m cohort

    If audit-eligible and 2027 gross revenue was between $50m and $100m as of Jan 1 2028, complete first audit report by April 1 2029 covering Jan 1 2028–Jan 1 2029. Imported research notes (check before approving): • Duty holder: regulated entity (Business subject to the CCPA) • Timing in the source: "April 1, 2029" • Flagged by the research: Exactly $50m and $100m boundary interpretation and interplay with the first audit cohorts needs legal review.

    AuditOne-time1 April 2029

    Source: § 7121(a)(2) · § 7121(a)(2) · page 75Suggested owner: Information Security

    View detailsTrack obligation

  • Complete first cybersecurity audit for <$50m cohort

    If audit-eligible and 2028 gross revenue was under $50m, complete first audit report by April 1 2030 covering Jan 1 2029–Jan 1 2030. Imported research notes (check before approving): • Duty holder: regulated entity (Business subject to the CCPA) • Timing in the source: "April 1, 2030"

    AuditOne-time1 April 2030

    Source: § 7121(a)(3) · § 7121(a)(3) · page 75Suggested owner: Information Security

    View detailsTrack obligation

  • Complete annual cybersecurity audits for subsequently qualifying businesses

    After April 1 2030, a business that meets §7120 as of Jan 1 must audit the next 12 months and complete report by April 1 of the following year. Imported research notes (check before approving): • Duty holder: regulated entity (Business subject to the CCPA) • Timing in the source: "by April 1 of the following year"

    AuditAnnuallyEvery 1 April

    Source: § 7121(b) · § 7121(b) · page 75Suggested owner: Information Security

    View detailsTrack obligation

  • Submit annual cybersecurity audit completion certification

    Submit annual written cybersecurity audit completion certification to the CPPA by April 1 following a year in which an audit was required, signed by a knowledgeable, responsible executive. Imported research notes (check before approving): • Duty holder: regulated entity (Business subject to the CCPA) • Goes to: regulator (California Privacy Protection Agency) • Timing in the source: "no later than April 1 following any year"

    FilingAnnuallyEvery 1 April

    Source: § 7124 · § 7124 · page 82Suggested owner: Compliance Officer

    View detailsTrack obligation

  • Review and update assessments at least every three years

    Reassess covered processing risk assessments at least once every three years and update where needed. Imported research notes (check before approving): • Duty holder: regulated entity (Business subject to the CCPA) • Timing in the source: "At least once every three years"

    ReviewEvery 3 yearsAt least once every three years — exact deadline not calculated

    Source: § 7155(a)(2) · § 7155(a)(2) · page 88Suggested owner: Privacy Officer

    View detailsTrack obligation

Sources & versions

Official sources

Version and updates

Version
2026 CCPA statute and implementing regulations
Published
Oct 29, 2026
Last reviewed
Oct 29, 2026

Consolidated January 1, 2026 CCPA statute and regulations; adds regulated milestones for audits, assessments and significant-decision ADMT, preserves earlier consumer rights.

Remindash provides this information to help organizations identify and track potential obligations. Applicability can depend on your organization's circumstances. Review official sources and obtain professional advice where appropriate.