California Consumer Privacy Act of 2018 self-assessment
A self-assessment based on California Consumer Privacy Act of 2018 (2026 CCPA statute and implementing regulations), last reviewed 2026-10-29.
10 questions in 3 sections
What this checklist covers
A draft self-assessment prepared from the researched requirements of California Consumer Privacy Act of 2018. Every question is unconfirmed: review the wording and citations before publishing.
How the self-assessment works
- Answer each question Yes, No or Not applicable. A No is a valid answer: it simply shows where you may want to look more closely.
- Add notes where they help, then review your answers before you finish. Attaching evidence is part of the assessment in a signed-in workspace, not of this public checklist.
- See a summary of what you answered. Your answers describe your own practices; they are not a legal finding.
Reviewing regularly helps you notice when your practices, systems or the policy itself change.
Start the self-assessmentSection 1 of 3
Review
- 1.
Do you test CCPA rights submission methods for functionality?
Test consumer request and consent methods and remedy burdens or broken/nonfunctional mechanisms that undermine consumer choices.
Source: § 7004(a)(5), p. 19
- 2.
Do you review substantiation for correction requests?
Accept and consider information supporting correction and apply permitted verification and dispute procedures without unnecessary collection.
Source: § 7023, p. 39
Section 2 of 3
Audit
- 1.
Do you use qualified and independent cybersecurity auditors?
Perform mandatory cybersecurity audits using qualified objective independent professionals under professionally accepted auditing standards; keep internal auditors separate from audited functions.
Source: § 7122(a), p. 75
- 2.
Do you protect independence of internal cybersecurity auditors?
Where an internal auditor is used, have its highest-ranking auditor report and be evaluated/paid via an executive without direct cybersecurity-program responsibility.
Source: § 7122(a)(3), p. 76
- 3.
Do you provide relevant business records and candid disclosures to auditors?
Make relevant information available to the cybersecurity auditor, make good-faith relevant fact disclosures, and do not misrepresent facts.
Source: § 7122(b)–(c), p. 76
- 4.
Do you meet this requirement: “Ensure cybersecurity audit findings are supported by evidence”?
Cybersecurity auditors must base findings primarily on appropriate documentary, sampling, testing and interview evidence rather than business management attestations.
Source: § 7122(d), p. 76
- 5.
Do you audit cybersecurity program and applicable security components?
Cybersecurity audit must examine documented cybersecurity program, enforcement, protection of data confidentiality/integrity/availability and applicable controls listed under §7123(c).
Source: § 7123(a)–(c), p. 77
- 6.
Do you meet this requirement: “Complete a cybersecurity audit when security-risk qualification is met”?
Businesses whose PI processing presents significant security risk under §7120(b) must complete a cybersecurity audit, subject to phased report deadlines.
Source: § 7120(a)–(b), p. 74
- 7.
Do you cooperate with business cybersecurity audit requests?
Service providers and contractors must make relevant information available for a CCPA business’s required cybersecurity audit and must not misrepresent relevant facts.
Source: § 7050(h)(1), p. 60
Section 3 of 3
Assessment
- 1.
Do you assess high-risk personal information processing?
Conduct risk assessments for each triggering activity under §7150(b), including sale/sharing of PI, sensitive-data processing, and specified ADMT or other high-risk technology activities.
Source: § 7150, p. 83
This checklist is a self-assessment tool provided for information. It is not legal advice, and completing it does not certify, verify or guarantee compliance with any law or regulation. Review dates you set are your own and are not legal deadlines.