California CCPA risk-assessment regulations
Enacted in force
In plain English
- CCPA-covered businesses conducting specified significant-risk processing under §7150(b). Primary source
- This does not cover all small businesses or make every ADMT/audit duty operative in 2026. Primary source
- Assess covered new significant-risk processing before initiating it from January 1, 2026. Primary source
- Assess existing continuing covered processing by December 31, 2027. Primary source
- Submit first required assessment summaries to CPPA by April 1, 2028. Primary source
Dates and phased obligations
Regulations effective January 1, 2026: assessment before initiating covered new processing. Existing continuing processing: December 31, 2027 deadline. First summaries to CPPA: April 1, 2028. Primary source
Questions from this record
Who does CA CCPA RISK cover?
CCPA-covered businesses conducting specified significant-risk processing under §7150(b). This does not cover all small businesses or make every ADMT/audit duty operative in 2026. Primary source
What is the law’s status?
Enacted / in force Primary source
What date does this record track?
Regulations effective January 1, 2026: assessment before initiating covered new processing. Existing continuing processing: December 31, 2027 deadline. First summaries to CPPA: April 1, 2028. Primary source
Has this record been verified?
This record’s accepted facts were last reviewed on 2026-11-13; unsupported comparison fields remain Unverified. Primary source
Not legal advice. This page restates the linked record and does not determine whether a particular business is covered. Methodology and verification limits.