{
 "record_id": "WTA-R-US-CA-0003-001",
 "kind": "obligation",
 "record": {
  "record_id": "WTA-R-US-CA-0003-001",
  "provision": "11 CCR Section 7150, 7152, 7155(a)",
  "applies_to": [
   "Anyone"
  ],
  "duty": "Conduct and document a risk assessment before starting processing that presents significant privacy risk, including using ADMT for significant decisions or training ADMT or facial recognition, and review it at least every three years.",
  "type": "Impact assessment",
  "status": "applies now",
  "applies_from": "2026-01-01",
  "url": "https://wheresthe.ai/id/WTA-R-US-CA-0003-001/",
  "rule": {
   "record_id": "WTA-R-US-CA-0003",
   "id": "us-ca-ccpa-admt-regulations-2025",
   "title": "CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits",
   "jurisdiction": "US-CA",
   "jurisdiction_name": "California",
   "url": "https://wheresthe.ai/rule/us-ca-ccpa-admt-regulations-2025/"
  },
  "penalty": "Administrative fines up to $2,663 per violation or $7,988 per intentional violation or violation involving known minors under 16 (Civil Code 1798.155(a), CPI-adjusted from 1 Jan 2025); AG civil penalties at the same levels (1798.199.90).",
  "scope_note": "Applies to businesses subject to the CCPA. Other triggers: selling or sharing personal information, processing sensitive personal information, and certain automated inferences about workers, students or people at sensitive locations (7150(b)). Keep assessments for the processing period or five years, whichever is later (7155(c)).",
  "date_note": "Regulations approved by OAL 22 Sep 2025 (adopted by the CPPA Board 24 Jul 2025); effective 1 Jan 2026. For covered processing begun before 1 Jan 2026 and continuing after, the assessment is due by 31 Dec 2027 (7155(b)). Updates are due within 45 days of a material change (7155(a)(3)).",
  "source_url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf",
  "verified_on": "2026-10-08",
  "citation": "WTA-R-US-CA-0003-001: 11 CCR Section 7150, 7152, 7155(a), CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0003-001/ (checked 2026-10-08)."
 },
 "history": [],
 "note": "Informational, not legal advice. Every record links to its official source; check it before relying on a record. Cite as \"Source: wheresthe.ai\"."
}