Complete first cybersecurity audit for $50m–$100m cohort
Under California Consumer Privacy Act of 2018
Overview
If audit-eligible and 2027 gross revenue was between $50m and $100m as of Jan 1 2028, complete first audit report by April 1 2029 covering Jan 1 2028–Jan 1 2029. Imported research notes (check before approving): • Duty holder: regulated entity (Business subject to the CCPA) • Timing in the source: "April 1, 2029" • Flagged by the research: Exactly $50m and $100m boundary interpretation and interplay with the first audit cohorts needs legal review.
Important
This requirement was extracted from the source document. Applicability depends on your organization's circumstances. Review the official source and obtain professional advice where appropriate.
Key information
- Policy
- CCPA
- Jurisdiction
- California
- Obligation type
- Audit
- Frequency
- One-time
- Suggested owner
- Information Security
- Policy categories
- Data Protection, Cybersecurity, Privacy, Compliance
- Source
- § 7121(a)(2), § 7121(a)(2), page 75
- Suggested reminders
- 30 days before · 7 days before · 1 day before
- Policy last reviewed
- Oct 29, 2026
Details
Who this may apply to
§7120 businesses with 2027 gross revenues between $50m and $100m as of January 1, 2028.
When this applies
One-time · 1 April 2029
From the source
“April 1, 2029, if the business’s annual gross revenue for 2027 was between fifty million dollars ($50,000,000) and one hundred million dollars ($100,000,000) as of January 1, 2028. The business’s audit would cover the period from January 1, 2028, through January 1, 2029. (3)”
§ 7121(a)(2), § 7121(a)(2), page 75
Other obligations in this policy
Explore other identified requirements from the same source policy.
Remindash provides this information to help organizations identify and track potential obligations. Applicability can depend on your organization's circumstances. Review official sources and obtain professional advice where appropriate.