Meet CCPA obligations, from privacy notices to cybersecurity audits

The CCPA is the California Consumer Privacy Act, a state law that gives California residents rights over their personal information and places duties on businesses that collect it. Since the CPRA amendments it includes rights to know, delete, correct, opt out of sale or sharing, and limit use of sensitive personal information. The California Privacy Protection Agency writes regulations under it and enforces it alongside the Attorney General.

For-profit businesses that collect California residents' personal information must comply if they meet one threshold: annual gross revenue above $26,625,000 (adjusted in 2025), buying, selling or sharing personal information of 100,000 or more consumers or households, or deriving at least 50% of annual revenue from selling or sharing personal information. Businesses outside California are covered if they meet these tests.

Administrative fines and civil penalties are up to $2,663 for each violation and up to $7,988 for each intentional violation or violation involving consumers known to be under 16, based on the inflation-adjusted amounts effective 1 January 2025. Consumers can also sue after certain data breaches caused by a failure to maintain reasonable security, with statutory damages of $107 to $799 per consumer per incident.

Regulations approved in September 2025 took effect on 1 January 2026. They update existing rules and add three new areas: annual cybersecurity audits for businesses whose processing presents significant security risk, risk assessments before high-risk processing such as selling or sharing data or processing sensitive data, and pre-use notice, opt-out and access rights for automated decisionmaking technology used for significant decisions, applying from 1 January 2027.

The first cybersecurity audit report is due by 1 April 2028 for businesses with 2026 revenue over $100 million, 1 April 2029 for those between $50 million and $100 million, and 1 April 2030 for those under $50 million. After that, audits run annually. The audit must be performed by a qualified, objective and independent auditor, and a certification of completion is submitted to the agency.

The CCPA and GDPR both grant individuals rights over personal data, but the CCPA centres on opt-out of sale and sharing rather than requiring a lawful basis for all processing. ISO 27001 is a voluntary security standard, not a privacy law, yet its controls support the CCPA's reasonable security duty and much of the scope of the new cybersecurity audit.

Start by mapping what personal information you collect and whether you sell or share it. Then publish a compliant privacy policy and notice at collection, set up request handling and opt-out preference signal support, update service provider contracts, train staff and keep records. Check whether the cybersecurity audit, risk assessment and ADMT rules apply, and plan for their deadlines.

Yes, on request. The CCPA regulations are mapped in OneClickComply's control library, so your existing controls and evidence can be linked to CCPA sections, including the cybersecurity audit and risk assessment requirements. OneClickComply helps you prepare and collect evidence, but it does not certify CCPA compliance; your cybersecurity audit must be completed by an independent auditor.