Law / United States / 
California
CCPA Regulations: risk assessments (article 10)
Also known as CCPA Regulations.
Cal. Code Regs. tit. 11, sections 7150 to 7157
In force since .
A comprehensive regime rule binding private bodies.
- Obligation class
- DPIA, Reporting, Retention
As of .
What it requires
- Before you start processing that presents significant risk to consumers' privacy (selling or sharing personal information, processing sensitive personal information other than for the employment purposes section 7150(b)(2)(A) lists, using automated decisionmaking technology for a significant decision, the inferences about applicants, students, employees, contractors or people in a sensitive location that section 7150(b)(4) and (5) describe, or training automated decisionmaking or facial-recognition or emotion-recognition technology), conduct a risk assessment (section 7150).
- In the risk assessment, document a specific purpose for the processing, the categories of personal information (the minimum necessary), the operational elements of the processing, the benefits, the negative impacts to consumers' privacy and their sources, and the safeguards, and weigh whether the risks outweigh the benefits (section 7152(a)).
- Review and update each risk assessment at least once every three years, and update it as soon as feasible and within 45 calendar days of a material change in the processing (section 7155(a)(2) and (3)).
- For processing you began before that continues after that day, complete and document the risk assessment no later than (section 7155(b)).
- Retain risk assessments, original and updated, for as long as the processing continues or for five years after completion, whichever is later (section 7155(c)).
- Submit the risk assessment information section 7157(b) lists to the Agency, with an attestation under penalty of perjury from a member of executive management, by for assessments conducted in 2026 and 2027 and by April 1 of each later year (section 7157).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
California Privacy Protection Agency, which may open an investigation on a sworn complaint or on its own initiative (section 7301(a) of the Regulations).
What this law does
Article 10 of the CCPA Regulations, sections 7150 to 7157, requires a business to conduct a risk assessment before it starts processing that presents significant risk to consumers' privacy. Selling or sharing personal information and processing sensitive personal information are among the activities that present significant risk.
The risk assessment must determine whether the risks to consumers' privacy from the processing outweigh the benefits to the consumer, the business, other stakeholders and the public. A business must review and update its risk assessments at least once every three years. A business must complete a risk assessment for processing it began before and continues after that day no later than .
A business must retain its risk assessments for as long as the processing continues or for five years after the completion of the risk assessment, whichever is later. For risk assessments conducted in 2026 and 2027, a business must submit the required information to the Agency no later than . The Agency's amended regulations carry an effective date of .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, processes voice recordings, processes biometric data or makes high-risk automated decisions.