United States of America: Published draft Risk Assessment Regulations
Description
Published draft Risk Assessment Regulations
On 28 August 2023, the California Privacy Protection Agency (CPPA) released materials ahead of its 8 September 2023 board meeting, including draft Risk Assessment Regulations. The CPPA clarified that formal rulemaking processes for cybersecurity audits, risk assessments, and automated decision-making technology have not yet begun. These drafts aim to facilitate board discussions and public involvement. The draft Risk Assessment Regulations set out when business must conduct risk assessments regarding their processing of consumer personal data. The Regulations also set out minimum requirements for such risk assessments.
Original sourceScope
Policy Area
Data governance
Policy Instrument
Data protection regulation
Regulated Economic Activity
cross-cutting
Implementation Level
subnational
Government Branch
executive
Government Body
data protection authority
Complete timeline of this policy change
Hide details
2023-08-28
under deliberation
2024-02-23
under deliberation
2024-11-22
in consultation
2025-01-14
processing consultation
2025-03-28
under deliberation
2025-05-09
under deliberation
2025-09-23
adopted
2026-01-01
in force