# CCPA Risk Assessment and Cybersecurity Audit Record: [Business name]

> Working record for the risk assessments and cybersecurity audits that
> the California Consumer Privacy Act (CCPA, Cal. Civ. Code 1798.100 and
> following) regulations require, as amended by the California Privacy
> Protection Agency (CPPA) package on CCPA updates, cybersecurity audits,
> risk assessments, automated decisionmaking technology (ADMT) and
> insurance. The package was approved by the Office of Administrative
> Law on 22 September 2025 and took effect on 1 January 2026 (Cal. Code
> Regs., title 11, Article 9 sections 7120 to 7124, Article 10 sections
> 7150 to 7157, Article 11 from section 7200). It covers the screening of
> processing activities, the risk assessment report, ADMT points,
> timing, retention, submissions to the Agency, cybersecurity audit
> applicability, auditor independence, audit scope and report, and the
> certification of completion. Replace every `[bracketed]` value and
> every row marked *Example*. This is a documentation format, not legal
> advice; check the current official text on the CPPA website and a
> qualified professional.

<!--
Guidance: How to use this template
- Part A (sections 3 to 10) is the risk assessment. Copy sections 5 to 7
  once per processing activity, or once per comparable set of
  activities (section 9). Part B (section 11) is the cybersecurity audit
  record, kept once per audit period.
- Screen first (section 3). Only the six processing activities in
  section 7150(b) need a risk assessment. Keep the screening for
  activities that do not, as the record of that decision.
- Write the purpose and benefits in specific terms. Section 7152 rejects
  generic statements such as "to improve our services".
- Do not name legal counsel who gave legal advice as a contributor or
  reviewer (section 7152(a)(8) and (9)); the regulation excludes them.
- The regulations do not prescribe a risk scoring scale. Section 5.5
  adds an optional likelihood and severity rating to help the decision;
  it is an internal aid, not a legal requirement.
- The worked example is fictional: Quenridge Rentals Inc., a residential
  property manager in California that uses an automated tenant screening
  score. Delete it.
- Related templates: Data Protection Impact Assessment
  (`compliance/dpia`) for the GDPR equivalent, Record of Processing
  Activities (`compliance/gdpr-ropa`), Privacy by Design Review
  (`compliance/privacy-by-design-review`), Privacy Threat Model
  (`security/privacy-threat-model`), AI Risk Assessment
  (`ai-data/ai-risk-assessment`), Supplier Security Assessment
  (`compliance/supplier-security-assessment`), NIST CSF Profile
  (`compliance/nist-csf`), SOC 2 Controls (`compliance/soc2-controls`),
  Privacy Policy (`legal-lite/privacy-policy`), Data Processing
  Agreement (`legal-lite/dpa`).
-->

## Document control

<!-- Guidance: Name the executive responsible for risk-assessment compliance and for cybersecurity-audit compliance. Sections 7157(c) and 7124(c) require submissions by a member of the executive management team with direct responsibility, knowledge and authority. -->

| Field | Value |
|---|---|
| Document ID | [CCPA-RA-YYYY-NNN] |
| Business | [Legal name], [address] |
| CCPA business threshold met (Civ. Code 1798.140(d)(1)) | [(A) revenue / (B) volume / (C) share of revenue from selling or sharing] |
| Executive responsible for risk-assessment compliance | [Name, title] |
| Executive responsible for cybersecurity-audit compliance | [Name, title] |
| Privacy lead | [@privacy-lead] |
| Version | [0.1] |
| Status | [Draft / In review / Approved / Submitted / Superseded] |
| Owner | [@privacy-lead] |
| Approvers/reviewers | [@decision-maker], [@ciso], [@business-owner] (legal counsel advises but is not listed, see guidance) |
| Next scheduled review | YYYY-MM-DD (at most three years after the last review) |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential] |

### Approvals

| Role | Name and position | Decision | Date |
|---|---|---|---|
| Decision-maker with authority to start the processing (section 7152(a)(9)) | [Name, position] | [Proceed / Proceed with conditions / Do not proceed] | YYYY-MM-DD |
| Privacy lead | [Name, position] | [Reviewed] | YYYY-MM-DD |
| Chief information security officer | [Name, position] | [Safeguards confirmed] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | Screening of processing activities |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Risk assessment RA-001 approved for tenant screening score |
| 1.1 | YYYY-MM-DD | [@name] | *Example:* Material change: new income data source; updated within 45 days |

## Contents

<!-- Guidance: Keep this list aligned with the headings below. Part A is sections 3 to 10; Part B is section 11. -->

1. [Purpose, scope and legal basis](#1-purpose-scope-and-legal-basis)
2. [Key dates](#2-key-dates)
3. [Screening of processing activities](#3-screening-of-processing-activities)
4. [Stakeholder involvement](#4-stakeholder-involvement)
5. [Risk assessment report](#5-risk-assessment-report)
6. [ADMT-specific content](#6-admt-specific-content)
7. [Weighing and decision](#7-weighing-and-decision)
8. [Timing, updates and retention](#8-timing-updates-and-retention)
9. [Comparable activities and reuse of other assessments](#9-comparable-activities-and-reuse-of-other-assessments)
10. [Submission to the Agency](#10-submission-to-the-agency)
11. [Cybersecurity audit record](#11-cybersecurity-audit-record)
12. [Traceability matrix](#12-traceability-matrix)
13. [Glossary and references](#13-glossary-and-references)

## 1. Purpose, scope and legal basis

<!-- Guidance: State which obligations this record serves. Pitfall: treating the risk assessment as a copy of a GDPR DPIA. The California content overlaps but adds items such as the approximate number of consumers, named recipients and the decision-maker's approval. -->

### 1.1 Purpose

This record documents how [Business] decides whether processing of
consumers' personal information that presents significant risk to
privacy should go ahead, and how it evidences an independent
cybersecurity audit where its processing presents significant risk to
security. The regulation states the goal of a risk assessment as
restricting or prohibiting processing when the risks to consumers'
privacy outweigh the benefits to the consumer, the business, other
stakeholders and the public (section 7154).

### 1.2 Legal basis

| Provision (Cal. Code Regs., tit. 11) | Subject (paraphrase) | Section of this template |
|---|---|---|
| 7150 | When a risk assessment is required: six processing activities | 3 |
| 7151 | Involvement of employees who take part in the processing; optional external parties | 4 |
| 7152 | Content of the risk assessment and report, points (a)(1) to (a)(9) | 5, 6, 7 |
| 7153 | Duties of a business that makes ADMT available to another business | 6.3 |
| 7154 | Goal of the risk assessment | 7 |
| 7155 | Timing, updates, transition for existing processing, retention | 8 |
| 7156 | Single assessment for comparable activities; reuse of assessments made for other laws | 9 |
| 7157 | Information submitted to the Agency and production on request | 10 |
| 7120 to 7124 | Cybersecurity audit: applicability, timing, independence, scope and report, certification | 11 |
| 7200 and following | ADMT: pre-use notice, opt-out, access (compliance by 1 January 2027 for existing use) | 6.4 |

The CCPA statute itself is in the California Civil Code, sections
1798.100 to 1798.199.100. Check the current regulation text and FAQs on
the CPPA website before each assessment; the Agency may amend the
regulations.

### 1.3 Comparable regimes

Where the same processing falls under other laws, align the records
instead of writing separate ones. Two named examples for orientation:
in the European Union and the United Kingdom, a data protection impact
assessment under Article 35 of the GDPR or UK GDPR
(`compliance/dpia`); in other US states, the data protection
assessments that several state privacy laws require for targeted
advertising, sale of data, sensitive data and certain profiling. Section
9 explains how section 7156(b) lets one assessment serve several
regimes if it contains every California element.

## 2. Key dates

<!-- Guidance: Put the dates that apply to this business in one table and keep it current. Every date below comes from the approved regulation text; confirm it again before relying on it. -->

| Obligation | Rule (paraphrase) | Date for [Business] |
|---|---|---|
| Regulations effective | Approved by OAL 22 September 2025, effective 1 January 2026 | 2026-01-01 |
| New in-scope processing | Risk assessment before the processing starts (7155(a)(1)) | Before start date of each activity |
| Existing in-scope processing started before 1 January 2026 and continuing | Risk assessment completed by 31 December 2027 (7155(b)) | 2027-12-31 |
| First submission of risk assessment information | For assessments conducted in 2026 and 2027, by 1 April 2028 (7157(a)(1)) | 2028-04-01 |
| Later submissions | By 1 April after each year in which assessments were conducted (7157(a)(2)) | Each 1 April |
| Periodic review | At least once every three years (7155(a)(2)) | [Date per assessment] |
| Material change | Update as soon as feasible, no later than 45 calendar days after the change (7155(a)(3)) | [Per change] |
| Production on request | Within 30 calendar days of a request by the Agency or the Attorney General (7157(e)) | [On request] |
| ADMT compliance for existing use | By 1 January 2027 (7200(b)) | 2027-01-01 |
| First cybersecurity audit report | 1 April 2028, 2029 or 2030 depending on revenue tier (7121(a)) | See section 11.2 |

## 3. Screening of processing activities

<!-- Guidance: Screen every processing activity in your data inventory against the six triggers of section 7150(b). One activity can meet several triggers; list all of them, because the Agency submission counts assessments per trigger. -->

### 3.1 Triggers

| Code | Trigger (paraphrase of section 7150(b)) |
|---|---|
| T1 | Selling or sharing personal information |
| T2 | Processing sensitive personal information (exception: employees' or contractors' sensitive personal information processed only for payroll, employment authorisation, benefits, legally required accommodation or wage reporting) |
| T3 | Using ADMT for a significant decision concerning a consumer |
| T4 | Using automated processing to infer or extrapolate attributes (such as ability, performance, health, preferences, reliability, behaviour, location) from systematic observation of a consumer acting as an educational program applicant, job applicant, student, employee or independent contractor |
| T5 | Using automated processing to infer or extrapolate such attributes (the list in T4 without location) from a consumer's presence in a sensitive location (exception: using the data only to deliver goods or provide transportation there) |
| T6 | Processing personal information the business intends to use to train ADMT for a significant decision, or to train facial-recognition, emotion-recognition or other identity verification or physical or biological identification or profiling technology |

"Significant decision" means a decision that results in providing or
denying financial or lending services, housing, education enrollment or
opportunities, employment or independent contracting opportunities or
compensation, or healthcare services. "Sensitive location" is defined
by a list in the regulations (for example healthcare facilities,
pharmacies, shelters, educational institutions, places of worship);
check section 7001 for the full definitions.

### 3.2 Screening register

| Activity ID | Processing activity | Triggers met | Assessment required | Assessment ID | Started before 2026-01-01? |
|---|---|---|---|---|---|
| PA-01 *(Example)* | Automated tenant screening score used to approve or decline rental applications | T2 (Social Security number), T3 (housing decision) | Yes | RA-001 | Yes (2024) |
| PA-02 *(Example)* | Sharing website visitor data with an advertising network for cross-context behavioural advertising | T1 | Yes | RA-002 | Yes |
| PA-03 *(Example)* | Payroll for site staff | T2, but within the employee exception | No | n/a | n/a |
| PA-04 *(Example)* | Maintenance request portal (contact details, unit number) | None | No | n/a | n/a |
| [PA-NN] | [Activity] | [Codes] | [Yes / No] | [RA-NNN] | [Yes / No] |

## 4. Stakeholder involvement

<!-- Guidance: Section 7151(a) requires employees whose duties include the processing to take part. Name them by role. External parties are optional under 7151(b) but useful for ADMT bias and consumer perspective. -->

| Role | Name | Contribution | Internal or external |
|---|---|---|---|
| Leasing operations manager *(Example)* | [Name] | Collection method, applicant journey, volumes | Internal |
| Data science lead *(Example)* | [Name] | Model logic, inputs, validation, limitations | Internal |
| Information security manager *(Example)* | [Name] | Safeguards, access, retention controls | Internal |
| Screening score vendor *(Example)* | [Company, contact] | Training data facts under 7153, model documentation | External (service provider) |
| Fair housing adviser *(Example)* | [Name] | Bias testing method and results review | External |
| [Role] | [Name] | [Contribution] | [Internal / External] |

## 5. Risk assessment report

<!-- Guidance: Sections 5.1 to 5.9 follow section 7152(a)(1) to (a)(9) in order. Keep the numbering so a reviewer from the Agency can find each element. Write one report per activity or comparable set. -->

Assessment ID: [RA-NNN]. Processing activity: [PA-NN]. Assessment
date: YYYY-MM-DD.

### 5.1 Purpose of the processing (7152(a)(1))

State the specific purpose. *Example:* "Decide within one business day
whether to approve, approve with a larger deposit, or decline an
application for a residential lease, using a score that predicts the
probability of rent default within 12 months." Not acceptable: "tenant
risk management".

### 5.2 Categories of personal information (7152(a)(2))

| Category | Sensitive? | Needed for purpose? | Minimum necessary | Source |
|---|---|---|---|---|
| Identifiers (name, contact details) *(Example)* | No | Yes | Name, email, phone | Applicant |
| Social Security number *(Example)* | Yes | Yes, identity match for credit report | Used for lookup, not stored after match | Applicant |
| Financial account data (bank statements) *(Example)* | No: an account number counts as sensitive only together with a log-in, access code or password (Civ. Code 1798.140(ae)(1)(B)); none is collected | Partly | Monthly income totals only; transaction detail discarded | Applicant upload |
| Credit report attributes *(Example)* | No | Yes | 14 attributes listed in model documentation | Consumer reporting agency |
| Eviction court records *(Example)* | No | Under review | Excluded pending legal review of local ordinances | Vendor |
| [Category] | [Yes / No] | [Yes / No / Partly] | [Minimum] | [Source] |

### 5.3 Operational elements (7152(a)(3))

| Point | Element | Entry |
|---|---|---|
| (A) | Method of collecting, using, disclosing, retaining or otherwise processing, and sources | *Example:* Online application form; vendor API returns score; leasing agent sees score band and reason codes |
| (B) | Retention per category, or criteria if unknown | *Example:* Application data 3 years after decision; bank statement files deleted within 7 days after income extraction |
| (C) | How the business interacts with consumers and why | *Example:* Website and leasing office, to process a rental application |
| (D) | Approximate number of consumers | *Example:* About 180,000 applicants per year |
| (E) | Disclosures made or planned, and how | *Example:* Notice at collection on the form; ADMT pre-use notice (section 6.4); adverse action notice |
| (F) | Names or categories of service providers, contractors or third parties receiving the information, and purpose | *Example:* Screening score vendor (service provider, scoring); consumer reporting agency (credit report); cloud host (service provider, hosting) |
| (G) | For ADMT used for a significant decision: logic, assumptions and limitations; output and how it is used | Section 6 |

### 5.4 Benefits (7152(a)(4))

| Beneficiary | Specific benefit | Evidence |
|---|---|---|
| Consumer *(Example)* | Decision within one business day instead of a typical five; consistent criteria for all applicants | Process metrics |
| Business *(Example)* | Lower default losses; fewer manual reviews | Back-test of score against 2023 to 2025 outcomes |
| Other stakeholders and public *(Example)* | Fewer vacant units, more predictable housing supply | Occupancy data |
| [Beneficiary] | [Benefit in specific terms] | [Evidence] |

### 5.5 Negative impacts, sources and causes (7152(a)(5))

The regulation lists examples of negative impacts to consider:
unauthorised access, destruction, use, modification or disclosure, and
loss of availability; unlawful discrimination on protected
characteristics; impaired consumer control over their information;
coercion or compelled consent, including through dark patterns;
economic harms; physical harms; reputational harms; and psychological
harms. Identify the source and cause of each impact.

The likelihood and severity columns are an optional internal aid (1
low to 3 high, score = likelihood x severity, range 1 to 9). They are
not required by the regulation.

| Impact ID | Negative impact | Source and cause | Likelihood | Severity | Score |
|---|---|---|---|---|---|
| NI-01 *(Example)* | Applicants in a protected class declined at higher rates | Proxy variables in credit attributes; training data reflects past lending patterns | 2 | 3 | 6 |
| NI-02 *(Example)* | Breach of Social Security numbers and bank statements | Upload storage and vendor API; account takeover of leasing staff | 2 | 3 | 6 |
| NI-03 *(Example)* | Applicant cannot understand or contest a decline | Score shown without reasons; no human review route | 3 | 2 | 6 |
| NI-04 *(Example)* | Economic harm: higher deposits for lower-income applicants | Deposit tier tied to score band | 2 | 2 | 4 |
| NI-05 *(Example)* | Applicant pressured to upload full bank statements when totals would do | Form design requires full statements | 3 | 1 | 3 |
| [NI-NN] | [Impact] | [Source and cause] | [1 to 3] | [1 to 3] | [n] |

### 5.6 Safeguards (7152(a)(6))

| Safeguard ID | Safeguard | Addresses | Owner | Residual likelihood | Residual severity | Residual score |
|---|---|---|---|---|---|---|
| SG-01 *(Example)* | Yearly disparate impact testing by an external adviser; remove or replace proxy attributes that fail | NI-01 | Data science lead | 1 | 3 | 3 |
| SG-02 *(Example)* | Encryption at rest and in transit, MFA for staff, deletion of statements within 7 days, vendor contract terms under section 7051 | NI-02 | Information security manager | 1 | 3 | 3 |
| SG-03 *(Example)* | Reason codes shown to applicants; human review on request by a trained leasing manager with authority to change the decision | NI-03 | Leasing operations manager | 1 | 2 | 2 |
| SG-04 *(Example)* | Cap on deposit increase; alternative evidence route (rent payment history) | NI-04 | Leasing operations manager | 1 | 2 | 2 |
| SG-05 *(Example)* | Accept income totals or a summary letter instead of full statements | NI-05 | Product owner | 1 | 1 | 1 |
| [SG-NN] | [Safeguard] | [NI-NN] | [Owner] | [1 to 3] | [1 to 3] | [n] |

The regulation gives further examples of safeguards: encryption,
segmentation, access controls, change management, network monitoring;
privacy-enhancing technologies such as trusted execution environments,
federated learning, homomorphic encryption and differential privacy;
consulting external parties; and policies, procedures and training so
that ADMT works for its purpose and does not unlawfully discriminate.

### 5.7 Whether the business will initiate the processing (7152(a)(7))

[Yes / Yes, with conditions / No]. *Example:* Yes, on condition that
SG-01 and SG-03 are live before the next leasing season and SG-05 within
90 days.

### 5.8 Contributors (7152(a)(8))

List the individuals who provided information for this assessment, by
name and role. Do not list legal counsel who provided legal advice.

| Name | Role | Information provided |
|---|---|---|
| [Name] | [Role] | [Section references] |

### 5.9 Review and approval (7152(a)(9))

| Name | Position | Reviewed or approved | Date | Authority to decide on the processing? |
|---|---|---|---|---|
| [Name] | [Position] | [Reviewed / Approved] | YYYY-MM-DD | [Yes / No] |

At least one approver must have authority to take part in deciding
whether the business will start the processing.

## 6. ADMT-specific content

<!-- Guidance: Fill this section when trigger T3 or T6 applies. Section 7152(a)(3)(G) requires the logic and output of the ADMT. Section 7153 adds duties for a business that supplies ADMT to another business. Article 11 sets consumer-facing duties. -->

### 6.1 Logic, assumptions and limitations

| Item | Entry |
|---|---|
| Technology and version | *Example:* Gradient-boosted model v3.2 supplied by the screening score vendor |
| Inputs | *Example:* 14 credit attributes, income-to-rent ratio, prior tenancy length |
| Logic in plain words | *Example:* Estimates the probability of 60 or more days of rent arrears within 12 months |
| Assumptions | *Example:* Past arrears patterns predict future ones; reported income is accurate |
| Known limitations | *Example:* Thin-file applicants (no credit history) are scored less accurately; model trained on data before 2025 rent levels |
| Validation | *Example:* Area under the ROC curve 0.74 on 2025 hold-out data; disparate impact ratio per protected class in SG-01 report |

### 6.2 Output and use in the significant decision

| Score band | Output | How it is used | Human involvement |
|---|---|---|---|
| A (low risk) *(Example)* | Approve | Automatic approval | Agent confirms identity only |
| B (medium) *(Example)* | Approve with deposit tier 2 | Automatic, applicant may request review | Review on request |
| C (high) *(Example)* | Refer | Leasing manager decides | Manager reviews file and may approve |

Whether the use counts as ADMT depends on whether the output replaces
or substantially replaces human decisionmaking. The regulation sets
conditions for human involvement (the reviewer knows how to interpret
the output, reviews it with other relevant information, and has
authority to make or change the decision). Record here why each band
does or does not meet those conditions.

### 6.3 ADMT supplied to other businesses (7153)

If [Business] makes ADMT available to another business for a
significant decision, it provides that business with all facts it has
that the recipient needs for its own risk assessment. This applies only
to ADMT trained using personal information. Record what was provided:
[document list, date, recipient].

### 6.4 Consumer-facing ADMT duties (Article 11)

| Duty | Status | Reference |
|---|---|---|
| Pre-use notice (section 7220), which may be given in the notice at collection | [Done / Planned] | [Link] |
| Opt-out of ADMT, or an exception the regulation allows (for example a human appeal route) | [Mechanism] | [Link] |
| Access to information about the ADMT use on request | [Process] | [Link] |
| Compliance date for use before 1 January 2027 | 2027-01-01 | Section 2 |

Check the current text of Article 11 for the exceptions and the content
of each notice; this table records status, not the legal conditions.

## 7. Weighing and decision

<!-- Guidance: Section 7154 states the goal. Explain in words why the benefits outweigh the residual risks, or why they do not. A table of scores is not a justification on its own. -->

| Question | Answer |
|---|---|
| Do the residual risks to consumers' privacy outweigh the benefits to consumers, the business, other stakeholders and the public? | [Yes / No, with reasoning] |
| Which residual risks remain highest after safeguards? | *Example:* NI-01 and NI-02 (residual score 3 each) |
| What conditions apply to proceeding? | *Example:* SG-01 and SG-03 before 2027-03-01; SG-05 within 90 days |
| What would trigger stopping the processing? | *Example:* Disparate impact ratio below the threshold set in the fair housing policy in two consecutive tests |
| Decision | [Proceed / Proceed with conditions / Restrict / Do not proceed] |

*Example:* Total optional score before safeguards 25 (6 + 6 + 6 + 4 +
3) and after safeguards 11 (3 + 3 + 2 + 2 + 1). Decision: proceed with
conditions, because faster and consistent decisions benefit applicants,
the highest residual risks have tested safeguards, and every applicant
has a human review route.

## 8. Timing, updates and retention

<!-- Guidance: Section 7155. Track each assessment's next review and every material change. A material change creates new negative impacts, increases their likelihood or size, or weakens safeguards. -->

| Assessment ID | Conducted | Last reviewed | Next review (3 years at most) | Material changes since | Updated within 45 days? | Retain until |
|---|---|---|---|---|---|---|
| RA-001 *(Example)* | 2026-05-12 | 2026-05-12 | 2029-05-12 | 2026-09-01 new income data source | Yes, 2026-10-02 (31 days) | Later of end of processing or 2031-10-02 |
| RA-002 *(Example)* | 2026-06-30 | 2026-06-30 | 2029-06-30 | None | n/a | Later of end of processing or 2031-06-30 |
| [RA-NNN] | YYYY-MM-DD | YYYY-MM-DD | YYYY-MM-DD | [Change, date] | [Yes / No, days] | [Rule] |

Retention rule (7155(c)): keep the original and every updated version
for as long as the processing continues or five years after completing
the assessment, whichever is later.

Examples of material change from the regulation: a change of purpose, a
change to the minimum personal information needed, or consumers raising
privacy risks (for example many complaints).

## 9. Comparable activities and reuse of other assessments

<!-- Guidance: Section 7156 allows one assessment for a set of similar activities with similar risks, and reuse of an assessment made for another law if every 7152 element is present or added. Record which option you used and the gap check. -->

### 9.1 Comparable set

| Set ID | Activities covered | Why they are comparable (same data, method, recipients, risks) |
|---|---|---|
| [SET-NN] | [PA-NN, PA-NN] | [Reason] |

### 9.2 Reuse gap check

| Section 7152 element | Present in the other assessment? | Added here |
|---|---|---|
| (a)(1) Specific purpose | [Yes / No] | [Text or reference] |
| (a)(2) Categories, including minimum necessary | [Yes / No] | [Reference] |
| (a)(3) Operational elements (A) to (G) | [Yes / No] | [Reference] |
| (a)(4) Benefits | [Yes / No] | [Reference] |
| (a)(5) Negative impacts with sources and causes | [Yes / No] | [Reference] |
| (a)(6) Safeguards | [Yes / No] | [Reference] |
| (a)(7) Whether processing will start | [Yes / No] | [Reference] |
| (a)(8) Contributors | [Yes / No] | [Reference] |
| (a)(9) Review and approval, including a person with decision authority | [Yes / No] | [Reference] |

A GDPR DPIA usually lacks the approximate number of consumers, the named
recipients with purposes, the decision on whether to start, and the name
and position of the decision-maker. Add them here.

## 10. Submission to the Agency

<!-- Guidance: Section 7157. The business submits summary information and an attestation, not the reports themselves; reports are produced only on request within 30 days. The submission is made on the CPPA website by an executive who meets 7157(c). -->

| Field (7157(b)) | Entry |
|---|---|
| (1) Business name and point of contact (name, phone, email) | [Entry] |
| (2) Period covered, by month and year | *Example:* January 2026 to December 2027 |
| (3) Number of assessments conducted or updated, in total and per trigger in 7150(b) | *Example:* 2 in total; T1: 1, T2: 1, T3: 1 (RA-001 counts under both T2 and T3) |
| (4) Whether the assessments involved each category of personal information and sensitive personal information listed in Civ. Code 1798.140(v)(1), (ae)(1) and (ae)(2) | [Category checklist reference] |
| (5) Attestation under penalty of perjury, in the wording the regulation sets | [Signed on portal] |
| (6) Name and title of the submitter and date | [Name, title, date] |

| Submitter test (7157(c)) | Met? |
|---|---|
| Member of executive management, directly responsible for risk-assessment compliance | [Yes / No] |
| Sufficient knowledge of the assessments to give accurate information | [Yes / No] |
| Authority to submit | [Yes / No] |

Production on request: [log of requests, date received, date produced,
within 30 calendar days?].

## 11. Cybersecurity audit record

<!-- Guidance: Part B. Sections 7120 to 7124. Decide applicability each year, plan the audit period, confirm auditor independence, and keep the report and certification. Pitfall: an audit that relies on management assertions; section 7122(d) forbids findings that rest primarily on them. -->

### 11.1 Applicability (7120)

| Test | Rule (paraphrase) | Result for [Business] |
|---|---|---|
| Revenue share test | Met the Civ. Code 1798.140(d)(1)(C) threshold (50% or more of annual revenue from selling or sharing personal information) in the preceding calendar year | *Example:* No |
| Revenue and volume test | Met the (d)(1)(A) revenue threshold (as adjusted; check the current figure) and, in the preceding calendar year, processed personal information of 250,000 or more consumers or households, or sensitive personal information of 50,000 or more consumers | *Example:* Yes: about 310,000 consumers in 2026 |
| Audit required? | Either test met | *Example:* Yes |

### 11.2 Timing (7121)

| Revenue tier | First audit period | First report due |
|---|---|---|
| 2026 revenue over USD 100 million (as of 1 January 2027) | 2027-01-01 to 2028-01-01 | 2028-04-01 |
| 2027 revenue USD 50 million to 100 million (as of 1 January 2028) | 2028-01-01 to 2029-01-01 | 2029-04-01 |
| 2028 revenue under USD 50 million | 2029-01-01 to 2030-01-01 | 2030-04-01 |
| After 2030 | Each year the criteria are met on 1 January for the preceding year, audit the next 12 months | 1 April of the following year |

*Example:* Quenridge Rentals had 2026 revenue of USD 68 million (not
over 100 million) and 2027 revenue of USD 74 million (in the 50 to 100
million tier), so its first audit covers 2028-01-01 to 2029-01-01 and
the report and certification are due by 2029-04-01.

### 11.3 Auditor and independence (7122)

| Requirement (paraphrase) | Evidence |
|---|---|
| Qualified, objective, independent professional using accepted auditing procedures and standards (for example AICPA, PCAOB, ISACA or ISO) | [Auditor, method] |
| Knowledge of cybersecurity and of auditing a cybersecurity program | [Qualifications] |
| Internal or external, but no participation in activities the auditor may assess (developing procedures, preparing documents, recommending program design, running the program) | [Independence statement] |
| Internal auditor: highest-ranking auditor reports to an executive without direct responsibility for the cybersecurity program, who also sets that auditor's evaluation and pay | [Reporting line] |
| Business gives the auditor all requested information and discloses relevant facts in good faith | [Confirmation] |
| Findings rely primarily on evidence (documents, sampling, testing, interviews), not management assertions | [Audit approach] |
| Report given to the executive directly responsible for the cybersecurity program | [Name, date] |
| Business and auditor keep audit documents at least five years | [Retention rule] |

### 11.4 Scope components (7123(c))

Mark each component the auditor deemed applicable and the result.

| No. | Component (short name) | Applicable | Result | Gap ID |
|---|---|---|---|---|
| 1 | Authentication, including phishing-resistant MFA and strong unique passwords | [Y / N] | [Effective / Gap] | [GAP-NN] |
| 2 | Encryption of personal information at rest and in transit | [Y / N] | [Result] | [ID] |
| 3 | Account management and access controls, privileged access, account creation, physical access | [Y / N] | [Result] | [ID] |
| 4 | Inventory and management of personal information and information systems, allowlisting, approval of hardware and software | [Y / N] | [Result] | [ID] |
| 5 | Secure configuration, updates, cloud and on-premises hardening, masking, patching, change management | [Y / N] | [Result] | [ID] |
| 6 | Vulnerability scans, penetration testing, vulnerability disclosure | [Y / N] | [Result] | [ID] |
| 7 | Audit-log management | [Y / N] | [Result] | [ID] |
| 8 | Network monitoring and defences, including intrusion detection and data loss prevention | [Y / N] | [Result] | [ID] |
| 9 | Antivirus and antimalware | [Y / N] | [Result] | [ID] |
| 10 | Segmentation | [Y / N] | [Result] | [ID] |
| 11 | Limitation and control of ports, services and protocols | [Y / N] | [Result] | [ID] |
| 12 | Cybersecurity awareness | [Y / N] | [Result] | [ID] |
| 13 | Cybersecurity education and training | [Y / N] | [Result] | [ID] |
| 14 | Secure development and coding practices | [Y / N] | [Result] | [ID] |
| 15 | Oversight of service providers, contractors and third parties | [Y / N] | [Result] | [ID] |
| 16 | Retention schedules and secure disposal | [Y / N] | [Result] | [ID] |
| 17 | Incident response management and its testing | [Y / N] | [Result] | [ID] |
| 18 | Business continuity and disaster recovery, including backups | [Y / N] | [Result] | [ID] |

The audit may assess additional components (7123(d)). An audit done for
another purpose, for example against the NIST Cybersecurity Framework
2.0, may be used if it meets every requirement, alone or with
supplements (7123(f)); map it with `compliance/nist-csf`.

### 11.5 Audit report contents (7123(e))

| Point | Content (paraphrase) | Location in report |
|---|---|---|
| (1) | Information system description; policies, procedures and practices assessed; criteria; evidence examined; why these justify the findings | [Section] |
| (2) | Applicable components and how the business implements and enforces them, with their effectiveness | [Section] |
| (3) | Gaps and weaknesses that increase risk, described in detail with status | [Section] |
| (4) | The business's plan and timeframe to resolve them | [Section] |
| (5) | Corrections or amendments to prior audit reports | [Section] |
| (6) | Titles of up to three qualified individuals responsible for the cybersecurity program | [Section] |
| (7) | Auditor name, affiliation and qualifications | [Section] |
| (8) | Signed and dated independence statement by the highest-ranking auditor | [Section] |
| (9) | Sample or description of breach notifications sent to consumers under Civ. Code 1798.82(a), without personal information | [Section] |
| (10) | Sample or description of required notifications to California privacy regulators, with dates, details and remediation | [Section] |

### 11.6 Gap plan

| Gap ID | Component | Description | Remediation | Owner | Due |
|---|---|---|---|---|---|
| GAP-01 *(Example)* | 1 Authentication | Leasing staff use SMS codes, not phishing-resistant MFA | Roll out FIDO2 security keys | IT manager | 2028-09-30 |
| GAP-02 *(Example)* | 16 Retention and disposal | Bank statement files found older than 7 days in a shared folder | Automated deletion job and monthly check | Information security manager | 2028-06-30 |
| [GAP-NN] | [Component] | [Description] | [Action] | [Owner] | YYYY-MM-DD |

### 11.7 Certification of completion (7124)

| Field | Entry |
|---|---|
| Calendar year of the audit requirement | [Year] |
| Due date (1 April following that year) | YYYY-04-01 |
| Business name and point of contact | [Name, phone, email] |
| Statement that the audit was completed | [Yes] |
| Period covered, by month and year | [Month YYYY to Month YYYY] |
| Attestation under penalty of perjury, in the wording the regulation sets, including that the business did not try to influence the auditor | [Signed on CPPA website] |
| Submitter name, business title and date | [Entry] |
| Submitter meets 7124(c) (executive, directly responsible, knowledgeable, authorised) | [Yes / No] |

## 12. Traceability matrix

<!-- Guidance: One row per obligation. Use it to check readiness before each 1 April deadline. -->

| Req ID | Provision | Obligation (short) | Section | Evidence | Status |
|---|---|---|---|---|---|
| REQ-01 | 7150 | Screen all processing activities | 3 | Screening register | [Status] |
| REQ-02 | 7151 | Involve employees who take part in the processing | 4 | Stakeholder table | [Status] |
| REQ-03 | 7152 | Complete report elements (a)(1) to (a)(9) | 5, 6 | RA reports | [Status] |
| REQ-04 | 7155(b) | Assess existing processing by 2027-12-31 | 8 | RA-001, RA-002 *(Example)* | [Status] |
| REQ-05 | 7155(a)(3) | Update within 45 days of material change | 8 | Change log | [Status] |
| REQ-06 | 7157 | Submit information and attestation by 1 April | 10 | Portal receipt | [Status] |
| REQ-07 | 7200(b) | ADMT duties in place by 2027-01-01 | 6.4 | Notices, opt-out or appeal process | [Status] |
| REQ-08 | 7120, 7121 | Audit applicability and timing decided | 11.1, 11.2 | Decision memo | [Status] |
| REQ-09 | 7122 | Independent, evidence-based audit | 11.3 | Engagement letter | [Status] |
| REQ-10 | 7123(e) | Report with all ten elements | 11.5 | Audit report | [Status] |
| REQ-11 | 7124 | Certification by 1 April | 11.7 | Portal receipt | [Status] |

## 13. Glossary and references

<!-- Guidance: Use the regulation's defined terms consistently. The meanings below are short paraphrases; the regulation's definitions in section 7001 govern. -->

### 13.1 Glossary

| Term | Meaning in this document |
|---|---|
| ADMT | Technology that processes personal information and uses computation to replace or substantially replace human decisionmaking |
| Significant decision | A decision that provides or denies financial or lending services, housing, education, employment or contracting opportunities or compensation, or healthcare services |
| Sensitive personal information | Categories defined in Civ. Code 1798.140(ae), such as government identifiers, account credentials, precise geolocation and health data |
| Cybersecurity program | The policies, procedures and practices that protect personal information and the information system |
| Material change | A change that creates new negative impacts, increases existing ones or weakens safeguards |
| Agency | The California Privacy Protection Agency (CPPA) |

### 13.2 References

| Reference | Version or date | Use |
|---|---|---|
| California Consumer Privacy Act, Cal. Civ. Code 1798.100 to 1798.199.100 | Check the current text on the California Legislative Information site | Thresholds, definitions |
| CPPA regulations, Cal. Code Regs., tit. 11, ch. 1 (CCPA updates, cybersecurity audits, risk assessments, ADMT and insurance package) | Board adopted 24 July 2025; OAL approved 22 September 2025; effective 1 January 2026 | Sections 2 to 12 |
| CPPA rulemaking page with the approved text and final statement of reasons | https://cppa.ca.gov/regulations/ccpa_updates.html | Source documents |
| GDPR Article 35 (EU) and UK GDPR Article 35 (UK) | Check the consolidated texts | Section 1.3 |

## Standard and licence note

Based on the California Consumer Privacy Act and the CPPA regulations in
California Code of Regulations, title 11, chapter 1, as amended by the
package approved by the Office of Administrative Law on 22 September
2025 and effective 1 January 2026 (Articles 9, 10 and 11). Section
numbers are cited and requirements are summarised in original wording;
attestation statements are referenced, not reproduced. The optional
scoring scale and all organisations, figures and identifiers in the
examples are fictional. Official text: California Privacy Protection
Agency, free of charge, https://cppa.ca.gov/regulations/. Check the
current text and the Agency's guidance before use. This is a
documentation format, not legal advice; consult a qualified
professional. Template licence: MIT.