Key Takeaways from "Navigating CA's Newest Consumer Privacy Act Requirements"

Coblentz special counsel Phillip Wiese presented “Navigating CA’s Newest Consumer Privacy Act Requirements: What Businesses Need to Know About Mandatory CCPA Risk Assessments and Cybersecurity Audits” during the Bar Association of San Francisco’s AI, Cybersecurity, and Privacy Section Conference on October 15, 2026. Phil and his co-panelists discussed the new requirements and steps companies can take to prepare an effective compliance program.

Key Takeaways 

Key Deadlines: Risk assessment obligations began January 1, 2026, with initial reporting to CalPrivacy due April 1, 2028. Cybersecurity audit deadlines are phased in beginning in 2028.

High-Risk Processing: Businesses must conduct risk assessments before undertaking certain activities with a “significant risk” to consumer privacy, including selling or sharing personal information, processing sensitive personal information, and using certain automated decision-making technologies.

Meaningful Risk Evaluations: Risk assessments must evaluate the benefits and potential privacy harms of covered processing activities—not simply check compliance boxes.

18 Cybersecurity Focus Areas: Required audits examine key safeguards, including access controls, encryption, vulnerability management, incident response, and third-party oversight.

Auditor Independence: Cybersecurity audits must be conducted by qualified, independent auditors, whether internal or external.

Start Preparing Now: Businesses should assess applicability, identify gaps, establish risk assessment procedures, and develop remediation plans well before applicable deadlines.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com or Phillip Wiese at pwiese@coblentzlaw.com for further information or assistance.