CCPA Risk Assessment and Cybersecurity Audit Template

CCPA Risk Assessment and Cybersecurity Audit Record: [Business name]

Working record for the risk assessments and cybersecurity audits that the California Consumer Privacy Act (CCPA, Cal. Civ. Code 1798.100 and following) regulations require, as amended by the California Privacy Protection Agency (CPPA) package on CCPA updates, cybersecurity audits, risk assessments, automated decisionmaking technology (ADMT) and insurance. The package was approved by the Office of Administrative Law on 22 September 2025 and took effect on 1 January 2026 (Cal. Code Regs., title 11, Article 9 sections 7120 to 7124, Article 10 sections 7150 to 7157, Article 11 from section 7200). It covers the screening of processing activities, the risk assessment report, ADMT points, timing, retention, submissions to the Agency, cybersecurity audit applicability, auditor independence, audit scope and report, and the certification of completion. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice; check the current official text on the CPPA website and a qualified professional.

Document control

Approvals

Revision history

Contents

1. Purpose, scope and legal basis
2. Key dates
3. Screening of processing activities
4. Stakeholder involvement
5. Risk assessment report
6. ADMT-specific content
7. Weighing and decision
8. Timing, updates and retention
9. Comparable activities and reuse of other assessments
10. Submission to the Agency
11. Cybersecurity audit record
12. Traceability matrix
13. Glossary and references

1. Purpose, scope and legal basis

1.1 Purpose

This record documents how [Business] decides whether processing of consumers' personal information that presents significant risk to privacy should go ahead, and how it evidences an independent cybersecurity audit where its processing presents significant risk to security. The regulation states the goal of a risk assessment as restricting or prohibiting processing when the risks to consumers' privacy outweigh the benefits to the consumer, the business, other stakeholders and the public (section 7154).

1.2 Legal basis

The CCPA statute itself is in the California Civil Code, sections 1798.100 to 1798.199.100. Check the current regulation text and FAQs on the CPPA website before each assessment; the Agency may amend the regulations.

1.3 Comparable regimes

Where the same processing falls under other laws, align the records instead of writing separate ones. Two named examples for orientation: in the European Union and the United Kingdom, a data protection impact assessment under Article 35 of the GDPR or UK GDPR (compliance/dpia); in other US states, the data protection assessments that several state privacy laws require for targeted advertising, sale of data, sensitive data and certain profiling. Section 9 explains how section 7156(b) lets one assessment serve several regimes if it contains every California element.

2. Key dates

3. Screening of processing activities

3.1 Triggers

"Significant decision" means a decision that results in providing or denying financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services. "Sensitive location" is defined by a list in the regulations (for example healthcare facilities, pharmacies, shelters, educational institutions, places of worship); check section 7001 for the full definitions.

3.2 Screening register

4. Stakeholder involvement

5. Risk assessment report

Assessment ID: [RA-NNN]. Processing activity: [PA-NN]. Assessment date: YYYY-MM-DD.

5.1 Purpose of the processing (7152(a)(1))

State the specific purpose. Example: "Decide within one business day whether to approve, approve with a larger deposit, or decline an application for a residential lease, using a score that predicts the probability of rent default within 12 months." Not acceptable: "tenant risk management".

5.2 Categories of personal information (7152(a)(2))

5.3 Operational elements (7152(a)(3))

5.4 Benefits (7152(a)(4))

5.5 Negative impacts, sources and causes (7152(a)(5))

The regulation lists examples of negative impacts to consider: unauthorised access, destruction, use, modification or disclosure, and loss of availability; unlawful discrimination on protected characteristics; impaired consumer control over their information; coercion or compelled consent, including through dark patterns; economic harms; physical harms; reputational harms; and psychological harms. Identify the source and cause of each impact.

The likelihood and severity columns are an optional internal aid (1 low to 3 high, score = likelihood x severity, range 1 to 9). They are not required by the regulation.

5.6 Safeguards (7152(a)(6))

The regulation gives further examples of safeguards: encryption, segmentation, access controls, change management, network monitoring; privacy-enhancing technologies such as trusted execution environments, federated learning, homomorphic encryption and differential privacy; consulting external parties; and policies, procedures and training so that ADMT works for its purpose and does not unlawfully discriminate.

5.7 Whether the business will initiate the processing (7152(a)(7))

[Yes / Yes, with conditions / No]. Example: Yes, on condition that SG-01 and SG-03 are live before the next leasing season and SG-05 within 90 days.

5.8 Contributors (7152(a)(8))

List the individuals who provided information for this assessment, by name and role. Do not list legal counsel who provided legal advice.

5.9 Review and approval (7152(a)(9))

At least one approver must have authority to take part in deciding whether the business will start the processing.

6. ADMT-specific content

6.1 Logic, assumptions and limitations

6.2 Output and use in the significant decision

Whether the use counts as ADMT depends on whether the output replaces or substantially replaces human decisionmaking. The regulation sets conditions for human involvement (the reviewer knows how to interpret the output, reviews it with other relevant information, and has authority to make or change the decision). Record here why each band does or does not meet those conditions.

6.3 ADMT supplied to other businesses (7153)

If [Business] makes ADMT available to another business for a significant decision, it provides that business with all facts it has that the recipient needs for its own risk assessment. This applies only to ADMT trained using personal information. Record what was provided: [document list, date, recipient].

6.4 Consumer-facing ADMT duties (Article 11)

Check the current text of Article 11 for the exceptions and the content of each notice; this table records status, not the legal conditions.

7. Weighing and decision

Example: Total optional score before safeguards 25 (6 + 6 + 6 + 4 + 3) and after safeguards 11 (3 + 3 + 2 + 2 + 1). Decision: proceed with conditions, because faster and consistent decisions benefit applicants, the highest residual risks have tested safeguards, and every applicant has a human review route.

8. Timing, updates and retention

Retention rule (7155(c)): keep the original and every updated version for as long as the processing continues or five years after completing the assessment, whichever is later.

Examples of material change from the regulation: a change of purpose, a change to the minimum personal information needed, or consumers raising privacy risks (for example many complaints).

9. Comparable activities and reuse of other assessments

9.1 Comparable set

9.2 Reuse gap check

A GDPR DPIA usually lacks the approximate number of consumers, the named recipients with purposes, the decision on whether to start, and the name and position of the decision-maker. Add them here.

10. Submission to the Agency

Production on request: [log of requests, date received, date produced, within 30 calendar days?].

11. Cybersecurity audit record

11.1 Applicability (7120)

11.2 Timing (7121)

Example: Quenridge Rentals had 2026 revenue of USD 68 million (not over 100 million) and 2027 revenue of USD 74 million (in the 50 to 100 million tier), so its first audit covers 2028-01-01 to 2029-01-01 and the report and certification are due by 2029-04-01.

11.3 Auditor and independence (7122)

11.4 Scope components (7123(c))

Mark each component the auditor deemed applicable and the result.

The audit may assess additional components (7123(d)). An audit done for another purpose, for example against the NIST Cybersecurity Framework 2.0, may be used if it meets every requirement, alone or with supplements (7123(f)); map it with compliance/nist-csf.

11.5 Audit report contents (7123(e))

11.6 Gap plan

11.7 Certification of completion (7124)

12. Traceability matrix

13. Glossary and references

13.1 Glossary

13.2 References

Standard and licence note

Based on the California Consumer Privacy Act and the CPPA regulations in California Code of Regulations, title 11, chapter 1, as amended by the package approved by the Office of Administrative Law on 22 September 2025 and effective 1 January 2026 (Articles 9, 10 and 11). Section numbers are cited and requirements are summarised in original wording; attestation statements are referenced, not reproduced. The optional scoring scale and all organisations, figures and identifiers in the examples are fictional. Official text: California Privacy Protection Agency, free of charge, https://cppa.ca.gov/regulations/. Check the current text and the Agency's guidance before use. This is a documentation format, not legal advice; consult a qualified professional. Template licence: MIT.