{
 "record_id": "WTA-R-US-CA-0003-004",
 "kind": "obligation",
 "record": {
  "record_id": "WTA-R-US-CA-0003-004",
  "provision": "11 CCR Section 7120-7124",
  "applies_to": [
   "Businesses"
  ],
  "duty": "Complete an annual independent cybersecurity audit if your processing presents significant security risk, and certify completion to the CPPA by each 1 Apr; the first report is due 1 Apr 2028, 2029 or 2030 by revenue.",
  "type": "Security testing",
  "status": "applies later",
  "applies_from": "2028-04-01",
  "url": "https://wheresthe.ai/id/WTA-R-US-CA-0003-004/",
  "rule": {
   "record_id": "WTA-R-US-CA-0003",
   "id": "us-ca-ccpa-admt-regulations-2025",
   "title": "CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits",
   "jurisdiction": "US-CA",
   "jurisdiction_name": "California",
   "url": "https://wheresthe.ai/rule/us-ca-ccpa-admt-regulations-2025/"
  },
  "penalty": "Administrative fines up to $2,663 per violation or $7,988 per intentional violation or violation involving known minors under 16 (Civil Code 1798.155(a), CPI-adjusted from 1 Jan 2025); AG civil penalties at the same levels (1798.199.90).",
  "scope_note": "Applies to businesses subject to the CCPA. Significant security risk: businesses deriving 50% or more of revenue from selling or sharing personal information, or meeting the revenue threshold and processing personal information of 250,000+ consumers or sensitive personal information of 50,000+ consumers (7120(b)).",
  "date_note": "Regulations approved by OAL 22 Sep 2025 (adopted by the CPPA Board 24 Jul 2025); effective 1 Jan 2026. First report due 1 Apr 2028 if 2026 revenue exceeded $100 million; 1 Apr 2029 if 2027 revenue was $50-100 million; 1 Apr 2030 if 2028 revenue was under $50 million; then each 1 Apr (7121).",
  "source_url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf",
  "verified_on": "2026-10-08",
  "citation": "WTA-R-US-CA-0003-004: 11 CCR Section 7120-7124, CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments and Cybersecurity Audits. wheresthe.ai, https://wheresthe.ai/id/WTA-R-US-CA-0003-004/ (checked 2026-10-08)."
 },
 "history": [],
 "note": "Informational, not legal advice. Every record links to its official source; check it before relying on a record. Cite as \"Source: wheresthe.ai\"."
}