Complete annual cybersecurity audits for subsequently qualifying businesses
Under California Consumer Privacy Act of 2018
Overview
After April 1 2030, a business that meets §7120 as of Jan 1 must audit the next 12 months and complete report by April 1 of the following year. Imported research notes (check before approving): • Duty holder: regulated entity (Business subject to the CCPA) • Timing in the source: "by April 1 of the following year"
Important
This requirement was extracted from the source document. Applicability depends on your organization's circumstances. Review the official source and obtain professional advice where appropriate.
Key information
- Policy
- CCPA
- Jurisdiction
- California
- Obligation type
- Audit
- Frequency
- Annually
- Suggested owner
- Information Security
- Policy categories
- Data Protection, Cybersecurity, Privacy, Compliance
- Source
- § 7121(b), § 7121(b), page 75
- Suggested reminders
- 30 days before · 7 days before · 1 day before
- Policy last reviewed
- Oct 29, 2026
Details
Who this may apply to
Businesses meeting §7120 qualification test in the prior calendar year after the initial audit phase-in.
When this applies
Annually · Every 1 April
From the source
“After April 1, 2030, if on January 1 of one year, a business meets the criteria of section 7120 for the preceding year, the business must complete a cybersecurity audit that covers the next 12 months, and the business must complete its cybersecurity audit report for that period”
§ 7121(b), § 7121(b), page 75
Other obligations in this policy
Explore other identified requirements from the same source policy.
Remindash provides this information to help organizations identify and track potential obligations. Applicability can depend on your organization's circumstances. Review official sources and obtain professional advice where appropriate.