Complete first cybersecurity audit for <$50m cohort
Under California Consumer Privacy Act of 2018
Overview
If audit-eligible and 2028 gross revenue was under $50m, complete first audit report by April 1 2030 covering Jan 1 2029–Jan 1 2030. Imported research notes (check before approving): • Duty holder: regulated entity (Business subject to the CCPA) • Timing in the source: "April 1, 2030"
Important
This requirement was extracted from the source document. Applicability depends on your organization's circumstances. Review the official source and obtain professional advice where appropriate.
Key information
- Policy
- CCPA
- Jurisdiction
- California
- Obligation type
- Audit
- Frequency
- One-time
- Suggested owner
- Information Security
- Policy categories
- Data Protection, Cybersecurity, Privacy, Compliance
- Source
- § 7121(a)(3), § 7121(a)(3), page 75
- Suggested reminders
- 30 days before · 7 days before · 1 day before
- Policy last reviewed
- Oct 29, 2026
Details
Who this may apply to
§7120 businesses with 2028 annual gross revenue under $50m.
When this applies
One-time · 1 April 2030
From the source
“April 1, 2030, if the business’s annual gross revenue for 2028 was less than fifty million dollars ($50,000,000). The business’s audit would cover the period from January 1, 2029, through January 1, 2030. (b) After April 1, 2030, if on January 1 of one year, a business meets”
§ 7121(a)(3), § 7121(a)(3), page 75
Other obligations in this policy
Explore other identified requirements from the same source policy.
Remindash provides this information to help organizations identify and track potential obligations. Applicability can depend on your organization's circumstances. Review official sources and obtain professional advice where appropriate.