United States of America: Privacy Protection Agency's Cybersecurity Audit Regulations
Progress
Scope
Timeline of events
California Consumer Privacy Act cybersecurity audit compliance regulations become applicable to businesses with revenues under USD 50 million
On 1 April 2030, businesses with annual gross revenues below USD 50 million reach the final compliance deadline under the California Consumer Privacy Act (CCPA) cybersecurity audit regulations and must submit certifications to the California Privacy…
SourceCalifornia Consumer Privacy Act cybersecurity audit compliance regulations become applicable to businesses with revenues between USD 50 million and USD 100 million
On 1 April 2029, businesses with annual gross revenues between USD 50 million and USD 100 million reach the second compliance deadline under the California Consumer Privacy Act (CCPA) cybersecurity audit regulations and must submit certifications to…
SourceCalifornia Consumer Privacy Act cybersecurity audit compliance regulations become applicable to businesses with revenues above USD 100 million
On 1 April 2028, businesses with annual gross revenues exceeding USD 100 million reach the first compliance deadline under the California Consumer Privacy Act (CCPA) cybersecurity audit regulations and must submit certifications to the California Pr…
SourceRegulations under California Consumer Privacy Act on cybersecurity audits enter into force with grace period
On 1 January 2026, the regulations adopted under the California Consumer Privacy Act (CCPA) enter into force following approval by the California Office of Administrative Law on 23 September 2025, establishing mandatory cybersecurity audit obligatio…
SourceOffice of Administrative Law adopted regulations under California Consumer Privacy Act on cybersecurity audits
On 23 September 2025, the California Office of Administrative Law adopted the regulations under the California Consumer Privacy Act (CCPA) on cybersecurity audits, with phased compliance deadlines linked to annual gross revenue. Beginning on 1 Janua…
SourceCalifornia Privacy Protection Agency published second updated draft amendments to CCPA regulations including proposed cybersecurity audits
On 9 May 2025, the California Privacy Protection Agency (CPPA) published modified text of proposed regulations under the California Consumer Privacy Act (CCPA) establishing mandatory cybersecurity audits for businesses whose processing of consumers’…
SourceCalifornia Privacy Protection Agency published updated draft amendments to CCPA regulations including proposed regulations on cybersecurity audits
On 28 March 2025, the California Privacy Protection Agency (CPPA) published its revised draft regulations on cybersecurity audits before its Board meeting. This follows a public consultation that closed on 14 January 2025. The updates to the regulat…
SourceClosed consultation on CPPA proposed regulations on cybersecurity audits
On 14 January 2025, the California Privacy Protection Agency (CPPA) closes the public consultation on proposed regulations on California Consumer Privacy Act (CCPA) updates, cybersecurity audits, risk assessments, automated decision-making technolog…
SourceOpened consultation on CPPA proposed regulations on cybersecurity audits
On 22 November 2024, the California Privacy Protection Agency (CPPA) opened the public consultation on proposed regulations on California Consumer Privacy Act (CCPA) updates, cybersecurity audits, risk assessments, automated decision-making technolo…
SourcePublished draft Cybersecurity Audit Regulations
On 28 August 2023, the California Privacy Protection Agency (CPPA) released materials ahead of its 8 September 2023 board meeting, including draft Cybersecurity Audit Regulations. The CPPA clarified that formal rulemaking processes for cybersecurity…
Source