When a Business Must Conduct a Risk Assessment

What it requires

Article 10, operative January 1, 2026, requires a documented risk assessment before a business initiates processing that presents significant risk to consumers’ privacy. Subsection (b) names six such activities: selling or sharing personal information; processing sensitive personal information (with a narrow carve-out for employee and contractor data used solely for payroll, employment authorization, benefits, legally required accommodation, or wage reporting); using ADMT for a significant decision; two kinds of automated inference about a consumer’s characteristics (one drawn from systematic observation of applicants, students, employees, or contractors, the other from a consumer’s presence in a sensitive location); and, under (b)(6), processing personal information the business intends to use to train an ADMT for a significant decision, or to train facial-recognition, emotion-recognition, or other technology that verifies a consumer’s identity or conducts physical or biological identification or profiling. That last trigger is the one that reaches a business which neither sells, shares, nor makes a significant decision, and “intends to use” is defined broadly enough to cover planning, permitting others to use, or merely advertising the use. Unlike the cybersecurity audit, this duty adds no revenue or volume floor beyond the CCPA’s own definition of a “business” in Civ. Code § 1798.140(d): for an entity that meets that definition, selling or sharing alone is enough. Section 7155(b) gives processing that began before January 1, 2026 and continues after it until December 31, 2027 to be assessed, and § 7157(a)(1) requires the first submission to the Agency, covering risk assessments conducted in 2026 and 2027, no later than April 1, 2028. Assessments must be reviewed at least once every three years, updated within 45 days of a material change, and retained for as long as the processing continues or five years, whichever is later.

Regulation text

(a) Every business whose processing of consumers’ personal information presents significant risk to consumers’ privacy as set forth in subsection (b) must conduct a risk assessment before initiating that processing. (b) Each of the following processing activities presents significant risk to consumers’ privacy: (1) Selling or sharing personal information. (2) Processing sensitive personal information. [...] (3) Using ADMT for a significant decision concerning a consumer. [...] (6) Processing the personal information of consumers, which the business intends to use to train an ADMT for a significant decision concerning a consumer; or train a facial-recognition, emotion-recognition, or other technology that verifies a consumer’s identity, or conducts physical or biological identification or profiling of a consumer. For purposes of this paragraph, “intends to use” means the business is using, plans to use, permits others to use, plans to permit others to use, is advertising or marketing the use of, or plans to advertise or market the use of.

California Consumer Privacy Act / California Privacy Rights Act, § 7150Read the full section from California Privacy Protection Agency (CalPrivacy)