Review and update assessments at least every three years
Under California Consumer Privacy Act of 2018
Overview
Reassess covered processing risk assessments at least once every three years and update where needed. Imported research notes (check before approving): • Duty holder: regulated entity (Business subject to the CCPA) • Timing in the source: "At least once every three years"
Important
This requirement was extracted from the source document. Applicability depends on your organization's circumstances. Review the official source and obtain professional advice where appropriate.
Key information
- Policy
- CCPA
- Jurisdiction
- California
- Obligation type
- Review
- Frequency
- Every 3 years
- Suggested owner
- Privacy Officer
- Policy categories
- Data Protection, Cybersecurity, Privacy, Compliance
- Source
- § 7155(a)(2), § 7155(a)(2), page 88
- Suggested reminders
- 30 days before · 7 days before · 1 day before
- Policy last reviewed
- Oct 29, 2026
Details
Who this may apply to
Businesses within the CCPA definition (including applicable affiliated, venture and voluntary coverage); subject to activity and data exemptions under Civil Code §§1798.140(d), 1798.145–1798.148.
When this applies
Every 3 years · At least once every three years — exact deadline not calculated
From the source
“At least once every three years, a business must review, and update as necessary, its risk assessments to ensure that they remain accurate in accordance with the requirements of this Article. (3) Notwithstanding subsection (a)(2) of this section, a business must update a risk”
§ 7155(a)(2), § 7155(a)(2), page 88
Other obligations in this policy
Explore other identified requirements from the same source policy.
Remindash provides this information to help organizations identify and track potential obligations. Applicability can depend on your organization's circumstances. Review official sources and obtain professional advice where appropriate.