CCPA Compliance and CPRA Readiness for California Businesses
What the law requires, who must comply, what your IT team has to build and what non-compliance costs. Explained in plain language, with the technical work done read-only.
Cybersecurity audits and risk assessments are now law
California’s new regulations took effect January 1, 2026. Risk assessments apply now to new high-risk processing, and the largest businesses must complete their first cybersecurity audit by April 1, 2028.
What CCPA compliance means for your business
The California Consumer Privacy Act (CCPA) gives California residents control over the personal information businesses collect about them. The California Privacy Rights Act (CPRA), approved by voters in November 2020, amended and expanded it and created a dedicated regulator, the California Privacy Protection Agency, which now calls itself CalPrivacy.
Today “CCPA” means the amended law. It covers customers, employees, job applicants and business contacts. It requires clear notices, working privacy-request processes, opt-outs, vendor contracts, data minimization and reasonable security. Since January 1, 2026, many businesses also need cybersecurity audits and risk assessments.
Most of that work lands on IT: finding the data, deleting it on request, honoring opt-out signals and proving that security controls work.
Which page answers your question?
We are not sure the law applies to us
Three thresholds decide it: revenue, the volume of personal information you buy, sell or share, and revenue from selling or sharing it.
We received a privacy request
For requests to know, delete or correct, the regulations allow 10 business days to confirm and 45 calendar days to respond. Opt-outs must be honored as soon as feasibly possible, and within 15 business days.
Our IT team needs a plan
Data maps, deletion runbooks, opt-out signals, encryption, logging and evidence, by system.
Leadership asks what the risk is
Fines per violation, breach lawsuits per consumer and settlements that already reach $12.75 million.
Nine guides, one program
Each page explains one part of the law: what it requires, how to implement it, what IT must do and what it costs to get wrong.
CCPA vs CPRA
What each law did, what changed in 2023 and the key dates through 2030.
CCPA vs CPRA explained →Does the CCPA apply?
The three thresholds, exempt data, affiliates and the extra 2026 obligations.
Check your thresholds →Consumer rights and requests
Know, delete, correct, opt out, limit. Deadlines, verification and the systems to search.
Handle privacy requests →Penalties, fines and lawsuits
Fine amounts, breach lawsuits, real enforcement cases and an exposure calculator.
See what it costs →Implementation roadmap
Eight phases from data map to evidence, and the dates to plan around.
Plan the program →CCPA for IT administrators
Ten tasks for IT and the 18 audit components translated into evidence.
Brief your IT team →CCPA cybersecurity audit
Who is in scope, the 2028 to 2030 deadlines, independence and certification.
Prepare for the audit →Risk assessments and ADMT
When a risk assessment is required and the automated decision-making rules for 2027.
Check your triggers →CCPA compliance checklist
60 checks with owners, scored as you go.
Run the checklist →California is enforcing, and the amounts are rising
largest announced CCPA settlement as of October 2026: General Motors, over the alleged sale of drivers’ data to data brokers
Source: California Attorney General, May 8, 2026consumer complaints received by CalPrivacy between July 2023 and March 2026
Source: CalPrivacy annual enforcement update, May 2026maximum fine per intentional violation, or per violation involving consumers the business knows are under 16
Source: CalPrivacy monetary adjustment, effective January 1, 2025to notify affected Californians after discovering a data breach
Source: SB 446, effective January 1, 2026What the CCPA requires, and who usually owns it
| Requirement | What it means in practice | Usual owner |
|---|---|---|
| Notice at collection and privacy policy | Tell people what you collect, why, how long you keep it and who receives it. Update the privacy policy at least once every 12 months. | Legal or privacy lead, marketing |
| Consumer requests | Know, delete, correct, opt out and limit. Confirm requests within 10 business days and answer within 45 calendar days. | Privacy lead with IT |
| Opt-out of sale and sharing | A “Do Not Sell or Share My Personal Information” link, honoring Global Privacy Control signals and showing the consumer that the opt-out worked. | Marketing and web IT |
| Sensitive personal information | Limit its use to permitted purposes, or offer a “Limit the Use of My Sensitive Personal Information” link. | Privacy lead, IT |
| Data minimization and retention | Collect, use and keep only what is reasonably necessary and proportionate to the purpose. | Business owners, IT |
| Vendor contracts | Required privacy terms with every service provider and contractor, and with third parties you sell or share personal information to. | Legal, procurement |
| Reasonable security | Security appropriate to the data. Breaches of nonencrypted, nonredacted personal information can lead to lawsuits with statutory damages. | IT and security |
| Cybersecurity audit (if in scope) | Annual independent audit and a certification to CalPrivacy, with first deadlines from April 1, 2028 to April 1, 2030. | Executive management, security |
| Risk assessments (if triggered) | Before high-risk processing, such as selling or sharing data, processing sensitive personal information or using automated decision-making for significant decisions. | Privacy lead, business owners, IT |
| Records | Keep records of consumer requests and responses for at least 24 months. | Privacy lead, IT |
Six parts of the CCPA that only IT can deliver
Find the data
An inventory of every system that holds personal information, including SaaS, backups and vendors.
Act on requests
Search, export, correct and delete across Microsoft 365, CRM, ERP, HR systems and file shares.
Honor opt-outs
Read Global Privacy Control, stop advertising tags for opted-out visitors and display the opt-out status.
Secure the data
MFA, encryption, least privilege, patching, logging, monitoring and tested backups.
Respond to breaches
Detect, contain and support notices to residents within 30 days and to the Attorney General when required.
Prove it
Evidence an independent auditor can test: configurations, logs, tickets, samples and reports.
What OC Security Audit does for CCPA
We handle the cybersecurity and technical side. Your counsel handles legal interpretation.
CCPA cybersecurity readiness assessment
A read-only gap assessment against the 18 cybersecurity components in the regulation, with evidence and a prioritized roadmap, done before your first audit period begins.
Independent CCPA cybersecurity audit
An evidence-based audit using documents, sampling, testing and interviews, with a report structured around the content listed in 11 CCR §7123; your counsel confirms that it meets the regulation. We do not design, implement or maintain a program we audit.
Technical support for privacy requests
Data inventories across Microsoft 365, file servers, SaaS and backups, deletion runbooks and opt-out signal testing on your website.
A read-only engagement in five steps
Scoping call
We document your systems, data and vendors and gather the facts your counsel needs to decide whether you are in scope for audits and risk assessments.
Read-only discovery
We inventory the systems that hold personal information and review configurations with read-only access. Configuration changes are out of scope.
Control assessment
Each applicable cybersecurity component is tested against evidence, not management’s word.
Risk-rated findings
Gaps are rated by impact on consumers’ personal information and mapped to NIST CSF 2.0.
Report and walkthrough
An executive summary and a technical report, walked through with your owner, counsel and IT lead.
A finding from a sample report
- Area
- Opt-out of sale and sharing
- Finding
- Website ignores the Global Privacy Control signal; advertising tags keep firing after an opt-out
- Severity
- High
- Evidence
- Browser test with GPC enabled: six advertising tags loaded on the home page and at checkout. No opt-out status shown. The consent tool’s GPC setting was turned off.
- Fix
- Turn on GPC handling in the consent tool, block advertising tags for opted-out visitors, display the opt-out status and retest after every website release.
Readiness reports pair each finding with its evidence and a recommended fix. Audit reports state findings and evidence, and management writes its own plan.
CCPA questions by industry
Healthcare and dental
Protected health information under HIPAA is exempt, but website, marketing and employee data usually are not.
CPA and tax firms
Client financial records, employee files and IRS WISP obligations, often on the same file server.
Law firms
Client and employee personal information spread across email, matter folders and document systems.
Real estate
Leads, transaction files and marketing lists, often shared with partners and advertising platforms.
Page 1 of 10: CCPA and CPRA compliance (hub)
- 1. CCPA and CPRA compliance (hub) (this page)
- 2. CCPA vs CPRA explained
- 3. Does the CCPA apply to your business?
- 4. Consumer rights and privacy requests
- 5. Penalties, fines and lawsuits
- 6. Implementation roadmap
- 7. CCPA for IT administrators
- 8. CCPA cybersecurity audit
- 9. Risk assessments and ADMT
- 10. CCPA compliance checklist
Guided by Ali Hassani, CISSP, C|CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure, who has earned dozens of Microsoft and Cisco certifications over his career, including MCSE, MCITP, MCSA Security, CCNP and CCNA. OC Security Audit handles the technical side of the CCPA: data inventories, security controls and evidence as your readiness advisor, or the cybersecurity audit as your independent auditor, one role per program. Legal interpretation stays with your privacy counsel.
Questions business owners and IT leaders ask
Is the CPRA a separate law from the CCPA?
No. The CPRA (Proposition 24, approved in November 2020) amended the CCPA. Most of its changes took effect January 1, 2023, and the combined law is still called the CCPA.
Does the CCPA apply to small businesses?
It applies to for-profit businesses that do business in California and meet one threshold: more than $26,625,000 in annual gross revenue (the adjusted amount since January 1, 2025), buying, selling or sharing the personal information of 100,000 or more consumers or households a year, or earning 50% or more of revenue from selling or sharing personal information. Many small businesses fall below all three.
Who enforces the CCPA?
The California Attorney General and CalPrivacy. Consumers can also sue after certain data breaches caused by a failure to maintain reasonable security.
Do employees count as consumers?
Yes. Since January 1, 2023, California employees, job applicants, contractors and business contacts have the same rights as customers, subject to the law’s exceptions.
What does OC Security Audit do for CCPA?
Readiness assessments against the cybersecurity audit components, independent cybersecurity audits, data and system inventories, and technical support for privacy requests and opt-out signals. We take one role per program: readiness advisor or independent auditor.
Is this legal advice?
No. We are a cybersecurity firm. Confirm legal applicability and interpretation with qualified California privacy counsel.
General information, not legal advice
This page summarizes California privacy law and regulations as of October 2026 to help businesses plan their cybersecurity and IT work. It is general information, not legal advice. It does not create an attorney-client relationship and does not guarantee compliance or any outcome. OC Security Audit is a cybersecurity firm, not a law firm. Confirm how the CCPA applies to your business with qualified California privacy counsel. Enforcement examples summarize the regulators’ public announcements; settlements can resolve allegations without an admission of wrongdoing. Laws, regulations and inflation-adjusted amounts change, so check the primary sources below.
Primary sources · Last reviewed October 2026
- California Civil Code, Title 1.81.5: California Consumer Privacy Act
- CalPrivacy: text of the CCPA regulations on cybersecurity audits, risk assessments and ADMT (effective January 1, 2026)
- CalPrivacy: CCPA updates, cybersecurity audit, risk assessment and ADMT rulemaking
- CalPrivacy: updated monetary thresholds in the CCPA (effective January 1, 2025)
- CalPrivacy: annual enforcement update, board meeting of May 1, 2026
- California Attorney General: General Motors settlement, May 8, 2026
- California Legislature: SB 446, data breach notification deadlines
- California Attorney General: California Consumer Privacy Act (CCPA)
Know where you stand before a regulator or a plaintiff asks
Schedule a consultation. We review how your business collects, stores and protects personal information and tell you what to fix first.
Read-only reviews. Irvine, Orange County and Southern California on-site; remote nationwide.