United States of America: Office of Administrative Law adopted regulations under California Consumer Privacy Act including risk assessment regulations
Description
Office of Administrative Law adopted regulations under California Consumer Privacy Act including risk assessment regulations
On 23 September 2025, the California Office of Administrative Law approved the final regulations under the California Consumer Privacy Act (CCPA), including requirements on risk assessments. Businesses subject to the risk assessment obligations must begin compliance on 1 January 2026, establishing internal processes to evaluate and document the impact of their data processing activities. By 1 April 2028, such businesses are required to submit to the CPPA both an attestation confirming that all required risk assessments have been completed and a summary of their risk assessment information. These measures form part of the regulatory package aimed at enhancing consumer protection and ensuring that organisations implement structured evaluation and accountability mechanisms in their data processing operations.
Original source