Complete first qualifying cybersecurity audit for >$100m cohort
Under California Consumer Privacy Act of 2018
Overview
If subject to annual cybersecurity audit and 2026 gross revenue exceeded $100m as measured Jan 1 2027, complete first report by April 1 2028 covering Jan 1 2027–Jan 1 2028. Imported research notes (check before approving): • Duty holder: regulated entity (Business subject to the CCPA) • Timing in the source: "April 1, 2028"
Important
This requirement was extracted from the source document. Applicability depends on your organization's circumstances. Review the official source and obtain professional advice where appropriate.
Key information
- Policy
- CCPA
- Jurisdiction
- California
- Obligation type
- Audit
- Frequency
- One-time
- Suggested owner
- Information Security
- Policy categories
- Data Protection, Cybersecurity, Privacy, Compliance
- Source
- § 7121(a)(1), § 7121(a)(1), page 75
- Suggested reminders
- 30 days before · 7 days before · 1 day before
- Policy last reviewed
- Oct 29, 2026
Details
Who this may apply to
Businesses meeting §7120 significant-security-risk test and >$100m gross revenue for 2026 as of Jan 1 2027.
When this applies
One-time · 1 April 2028
From the source
“April 1, 2028, if the business’s annual gross revenue for 2026 was more than one hundred million dollars ($100,000,000) as of January 1, 2027. The business’s audit would cover the period from January 1, 2027, through January 1, 2028. (2) April 1, 2029, if the business’s annual”
§ 7121(a)(1), § 7121(a)(1), page 75
Other obligations in this policy
Explore other identified requirements from the same source policy.
Remindash provides this information to help organizations identify and track potential obligations. Applicability can depend on your organization's circumstances. Review official sources and obtain professional advice where appropriate.