CCPA Implementation Roadmap: From Data Map to Documented Evidence
Eight phases that take a business from “we think we’re fine” to working processes, tested controls and records that document them.
Dates to plan around in 2026, 2027 and 2028
Automated decision-making rules and wider deletion rights on January 1, 2027, risk assessments for existing processing by December 31, 2027, first submissions on April 1, 2028.
How to implement CCPA compliance without stalling the business
Privacy programs stall when they start with the policy. Start with the data instead: what you collect, where it lives, who receives it and why. Every other requirement depends on that map.
Then build the processes consumers will test (requests and opt-outs), fix the security gaps that create lawsuit exposure, and keep evidence as you go.
Eight phases, each with an owner and an output
Confirm applicability and scope
Decide whether the CCPA applies, whether you are in scope for cybersecurity audits and which processing triggers risk assessments.
Map personal information
Inventory every system that holds personal information, on-premises, in the cloud, in SaaS, in backups and at vendors. Record categories, sensitive data, sources, purposes, recipients and retention.
Classify sharing and vendors
Label each vendor as a service provider, contractor or third party. Review advertising and analytics tools for sale or sharing. Put the required terms in each contract that needs them.
Update notices and links
Notice at collection, a privacy policy updated at least every 12 months, employee and applicant notices, and the opt-out links your activities require.
Build request and opt-out processes
Intake methods, verification rules, a runbook per system, Global Privacy Control handling, opt-out status display and a 24-month request log.
Minimize and secure
Apply retention schedules and deletion jobs. Close security gaps, starting with encryption, MFA and access control, and map your controls to the 18 audit components.
Assess risk and automated decisions
Run risk assessments before high-risk processing starts. Where automated decision-making drives significant decisions, prepare notices, opt-outs or appeals by January 1, 2027.
Prove and maintain
Annual cybersecurity audit if in scope, certifications and submissions to CalPrivacy, training, regular opt-out tests and an annual policy review.
What is due, and when
| Date | What is due | Who it applies to |
|---|---|---|
| Already in force (since January 1, 2026) | Opt-out status display, risk assessments before new high-risk processing, breach notices to residents within 30 days of discovery | Covered businesses; breach notices apply to any business holding Californians’ computerized personal information |
| January 1, 2027 | Automated decision-making rules for existing uses; deletion covers data obtained from other sources and online-only businesses need an online request method (SB 923); browsers must offer an opt-out signal (AB 566) | Businesses using ADMT for significant decisions; all covered businesses; browser makers |
| December 31, 2027 | Risk assessments for processing that began before 2026 and continues | Businesses with high-risk processing |
| April 1, 2028 | Risk assessment information for 2026 and 2027 submitted to CalPrivacy; first cybersecurity audit for businesses with more than $100 million in 2026 revenue | As applicable |
| April 1, 2029 | First cybersecurity audit for businesses with $50 million to $100 million in 2027 revenue | Businesses in audit scope |
| April 1, 2030 | First cybersecurity audit for businesses with under $50 million in 2028 revenue | Businesses in audit scope |
CCPA is a team sport
| Workstream | Leads | Supports |
|---|---|---|
| Applicability and legal interpretation | Legal counsel or privacy lead | Executive sponsor, IT |
| Data inventory and map | IT administrators | Business owners, privacy lead |
| Notices and privacy policy | Privacy lead | Marketing, HR, IT |
| Consumer requests | Privacy lead | IT for search and deletion, customer service |
| Opt-out signals and advertising tags | Web or marketing IT | Privacy lead, marketing |
| Vendor contracts | Legal and procurement | IT for technical due diligence |
| Security controls | IT and security | Executive sponsor for funding |
| Risk assessments | Privacy lead and the business owner of the activity | IT, security |
| Breach response and notices | Incident response lead | Legal, IT, executive management |
| Cybersecurity audit certification | Executive management | Independent auditor, IT, security |
Six pitfalls cited in enforcement actions
Treating a cookie banner as an opt-out
The regulations say a cookie banner alone is not an acceptable opt-out method. CalPrivacy’s action against PlayOn cited, in part, making users accept tracking to use their tickets.
Opt-outs that stop at one device
The Attorney General alleged that Disney’s opt-outs did not follow the consumer across services and devices; Disney agreed to a $2.75 million settlement.
Asking for too much to opt out
CalPrivacy’s actions against Honda, Ford and Todd Snyder each cited verification or extra steps in the opt-out process.
Missing vendor contracts
The actions against Tractor Supply, Healthline and Honda each cited data shared without the required contract terms.
Forgetting employees and applicants
The Tractor Supply decision cited a failure to tell job applicants about their privacy rights.
Using data beyond its purpose
The Attorney General alleged that General Motors used driving data for purposes drivers did not expect; GM agreed to a $12.75 million settlement.
A finding from a sample report
- Area
- Data inventory
- Finding
- Three cloud apps holding customer data were unknown to the privacy team
- Severity
- High
- Evidence
- A review of firewall logs and Microsoft Entra sign-in logs found 41 cloud apps in use. Three held customer personal information (a survey tool, a file-transfer service and a support chat tool) with no contract review.
- Fix
- Add them to the inventory, sign service-provider terms or replace them, and route new apps through an approval step.
The calendar behind the roadmap
automated decision-making compliance date for existing significant-decision uses
Source: 11 CCR §7200(b)risk assessments due for processing that began before 2026 and continues
Source: 11 CCR §7155(b)first risk assessment submissions and first cybersecurity audits (largest businesses)
Source: 11 CCR §§7121, 7157maximum time between privacy policy updates
Source: Civil Code §1798.130(a)(5)Page 6 of 10: Implementation roadmap
- 1. CCPA and CPRA compliance (hub)
- 2. CCPA vs CPRA explained
- 3. Does the CCPA apply to your business?
- 4. Consumer rights and privacy requests
- 5. Penalties, fines and lawsuits
- 6. Implementation roadmap (this page)
- 7. CCPA for IT administrators
- 8. CCPA cybersecurity audit
- 9. Risk assessments and ADMT
- 10. CCPA compliance checklist
Guided by Ali Hassani, CISSP, C|CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure, who has earned dozens of Microsoft and Cisco certifications over his career, including MCSE, MCITP, MCSA Security, CCNP and CCNA. OC Security Audit handles the technical side of the CCPA: data inventories, security controls and evidence as your readiness advisor, or the cybersecurity audit as your independent auditor, one role per program. Legal interpretation stays with your privacy counsel.
Questions business owners and IT leaders ask
Where should we start?
With the data map. Notices, requests, contracts, risk assessments and audits all depend on knowing what you hold and where.
Do we need to buy a privacy platform?
Not necessarily. Smaller businesses often run requests from an existing ticketing system with written runbooks. The test is whether requests are handled correctly and on time, with records.
How often should we test opt-outs?
We recommend after every website release and at least monthly. In CalPrivacy’s Todd Snyder decision, the consent tool had been broken for 40 days.
Who should own the CCPA program?
A named executive sponsor, a privacy lead (often legal) and an IT owner for each system that holds personal information.
Can OC Security Audit run the whole program?
We handle the cybersecurity and technical work and can assess your readiness. Legal interpretation stays with your counsel. If you want us as your independent auditor, we take only that role: an auditor may not advise on, build or run the program it audits.
General information, not legal advice
This page summarizes California privacy law and regulations as of October 2026 to help businesses plan their cybersecurity and IT work. It is general information, not legal advice. It does not create an attorney-client relationship and does not guarantee compliance or any outcome. OC Security Audit is a cybersecurity firm, not a law firm. Confirm how the CCPA applies to your business with qualified California privacy counsel. Enforcement examples summarize the regulators’ public announcements; settlements can resolve allegations without an admission of wrongdoing. Laws, regulations and inflation-adjusted amounts change, so check the primary sources below.
Primary sources · Last reviewed October 2026
- California Civil Code, Title 1.81.5: California Consumer Privacy Act
- CalPrivacy: text of the CCPA regulations on cybersecurity audits, risk assessments and ADMT (effective January 1, 2026)
- CalPrivacy: CCPA updates, cybersecurity audit, risk assessment and ADMT rulemaking
- CalPrivacy: SB 923 strengthens deletion rights (signed September 27, 2026)
- California Legislature: AB 566, California Opt Me Out Act
- California Legislature: SB 446, data breach notification deadlines
- California Attorney General: Disney settlement, February 11, 2026
- CalPrivacy: American Honda Motor Co. settlement, March 12, 2025
- CalPrivacy: Ford Motor Company decision, March 5, 2026
- CalPrivacy: Todd Snyder, Inc. decision, May 6, 2025
- CalPrivacy: Tractor Supply Company decision, September 30, 2025
- California Attorney General: Healthline settlement, July 1, 2025
- CalPrivacy: PlayOn Sports decision, March 3, 2026
- California Attorney General: General Motors settlement, May 8, 2026
Turn the roadmap into your plan
Schedule a consultation. We assess the technical and security phases, list the open legal items for your counsel, and give you a prioritized plan with owners and dates.
Read-only reviews. Irvine, Orange County and Southern California on-site; remote nationwide.