California's updated CCPA regulations add cybersecurity audits, risk assessments and automated decisionmaking rules, with deadlines phased from 2026 to 2030. Continuous monitoring after your first privacy review means checking a short list of controls on a schedule and keeping dated proof, so the next audit is a collection job, not a scramble.
What did California actually change?
On 23 September 2025 the California Privacy Protection Agency announced that the Office of Administrative Law had approved new regulations on cybersecurity audits, risk assessments, automated decisionmaking technology (ADMT), insurance companies and updates to existing CCPA rules. The general effective date was 1 January 2026, with later dates for some obligations.
According to the agency:
- Risk assessment compliance begins 1 January 2026, and by 1 April 2028 businesses must submit an attestation that required assessments were completed, plus a summary of the information.
- Businesses that use ADMT to make significant decisions must comply beginning 1 January 2027.
- Cybersecurity audit certifications are due on a revenue-based schedule: 1 April 2028 for businesses above 100 million dollars, 1 April 2029 for those between 50 and 100 million, and 1 April 2030 for those below 50 million.
Which of these applies to you depends on thresholds in the regulation text. Read it, or ask counsel, before assuming you are in or out.
Why does a one-time audit not hold?
An audit is a photograph. Your systems keep changing: new vendors receive personal information, engineers ship new data flows, a dependency picks up a vulnerability. A control that passed in March can quietly fail in June. If your first formal review is the audit itself, you learn about failures at the worst moment.
What should we monitor between audits?
Choose controls that connect to personal information and that produce a signal you can check without much effort.
- Where personal information goes. Keep a living inventory of systems and vendors that receive it. Review it whenever procurement signs a new tool, and at least quarterly.
- Who can reach it. Run a regular access review on systems holding personal information. Remove leavers and unused privileges.
- Known flaws in what handles it. Track vulnerabilities in the applications and dependencies that touch personal information, with the date each was resolved. Reachability analysis helps separate exposed flaws from theoretical ones.
- Risk assessment triggers. Add a gate to your change process that asks whether a new feature sells, shares or profiles personal data, or uses automated tools for significant decisions. If yes, a risk assessment is started before launch.
- Consumer requests. Track volume, response time and failures, since requests are where privacy controls meet real users.
How do we keep the evidence usable?
Store each check as a short record: what was checked, the date, who checked, the result, and what was done about exceptions. Automation can run the checks and collect output, and a compliance automation tool can hold the records, but a named person must still own each control. When an exception stays open for more than one cycle, escalate it in writing.
Keep a change log too. When a data flow changes, record what changed and which controls were re-checked. That log makes the audit conversation short.
What to do
- Read the regulation text and confirm which obligations and deadlines apply to your business.
- Build and maintain an inventory of systems and vendors that receive personal information.
- Schedule quarterly access reviews on those systems.
- Track vulnerabilities in code and dependencies that touch personal information, with closure dates.
- Add a risk assessment trigger to your change process.
- Track consumer request volume and response times monthly.
- Store dated records, with an owner for each control.
- Review open exceptions each quarter and escalate stale ones.
Quick check
When do the new California cybersecurity audit certifications start?
Per the California Privacy Protection Agency, the first are due 1 April 2028 for the largest businesses, with later dates in 2029 and 2030 for smaller ones.
Is a Safeguard scan enough for CCPA compliance?
No. Scans and compliance automation can supply evidence for some security controls, but privacy compliance also covers notices, consumer rights and assessments that need people and process.
Sources
Last reviewed: 18 October 2026.
