Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 26 OCTOBER 2026

California Cybersecurity Audits: Preparation Needs To Start Now

Barnes & Thornburg LLP
Explore more from Barnes & Thornburg LLP

California's new cybersecurity audit requirements under CCPA are set to take effect in 2027, with phased implementation based on company revenue. Companies that derive significant revenue from selling or sharing personal information, or process data about large numbers of consumers, must prepare now for independent audits that evaluate the implementation and effectiveness of their cybersecurity controls.

United StatesPrivacy
Brian McGinnis
Brian McGinnis
Author LinkedIn connections

This is part two of a four-part series highlighting key learnings from the IAPP Privacy. Security. Risk. + AI Governance Global conference.

California's new cybersecurity audit requirements were among the most practical issues discussed in Seattle. Several sessions, including CCPA Article 9: Preparing for a New Kind of Audit, addressed the work companies need to undertake before their first audit periods begin.

Under 11 CCR Section 7120, the requirements apply to CCPA-covered businesses that derive at least half their annual revenue from selling or sharing personal information, or that meet the CCPA revenue threshold and process personal information about at least 250,000 consumers or households, or sensitive personal information about at least 50,000 consumers. In my experience, a lot more companies are in scope of these audits than currently realize.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

SB 54 Is In Effect: What California’s New Packaging Law Means For Your Business

Although being challenged by an injunction filed on August 20, 2026, by a coalition of 17 states, California’s SB 54 Plastic Pollution Prevention and Packaging Producer Responsibility Act is now in effect, and companies that sell, distribute, import, or ship packaged products into California should be evaluating whether they have compliance obligations.
United StatesPrivacy
Wilson Elser Moskowitz Edelman & Dicker LLP
Wilson Elser Moskowitz Edelman & Dicker LLP
Article

California’s 2026 Legislative Session Wraps: A Wave Of Privacy And AI Bills Reaches The Governor, With Key Child Safety And AI Measures Signed Into Law

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?
United StatesPrivacy
Kelley Drye & Warren LLP
Kelley Drye & Warren LLP
Article

California's Fall 2026 Privacy Roundup: Expanded CCPA Deletion Rights And More

California Governor Gavin Newsom has signed several significant privacy bills that will reshape how businesses handle consumer data, including expanded deletion rights under the CCPA, shortened data broker response cycles, and sweeping new insurance sector privacy requirements. While one landmark bill banning the sale of sensitive personal information was vetoed, the approved legislation requires companies to update their deletion workflows...
United StatesPrivacy
McDermott Will & Schulte
McDermott Will & Schulte
Article

The Data Breach Brief: Week Of September 30th, 2026

Multiple organizations have recently disclosed significant data breaches affecting thousands of individuals, with compromised information ranging from basic contact details to highly sensitive medical records and financial data. The incidents span various sectors including healthcare, insurance, and professional services, raising questions about the scope of exposure and potential remedies for affected individuals.
United StatesPrivacy
Morgan & Morgan
Morgan & Morgan
Article

Emerging Enforcement Trends In Digital Health Data Privacy: Lessons From Washington’s My Health My Data, FTC vs. Hims & Hers And UCHealth Enforcement Actions

Federal and state regulators are intensifying scrutiny of healthcare and digital health companies over tracking technologies that share sensitive patient data with advertising platforms. Recent enforcement actions against major telehealth providers and healthcare systems reveal how common marketing practices can trigger significant legal liability under privacy laws, even for organizations not covered by HIPAA.
United StatesPrivacy
Benesch, Friedlander, Coplan & Aronoff LLP
Benesch, Friedlander, Coplan & Aronoff LLP
Article

California Legislation: End-Of-Session Check-In

California's legislature has sent a comprehensive package of privacy, AI, and advertising bills to Governor Newsom's desk, with decisions due by September 30, 2026. The legislation addresses sensitive personal information protections, data broker obligations, AI-powered chatbot regulations, and digital replica rights, potentially reshaping how businesses handle consumer data and automated decision-making systems. Will these bills become law and set new national standards for technology regulation?
United StatesPrivacy
Frankfurt Kurnit Klein & Selz PC
Frankfurt Kurnit Klein & Selz PC
Article

IEEPA Tariff Refunds: Critical Developments, Phase III Delays, And Action Steps For Importers

U.S. Customs and Border Protection has begun processing IEEPA tariff refunds through its CAPE system, but Phase III covering finally liquidated entries faces delays and requires court orders. With the Department of Justice appealing the universal refund order and class certification pending, importers with finally liquidated entries may need to file individual lawsuits at the Court of International Trade to preserve their claims before statutory deadlines expire.
United StatesInternational Law
Barnes & Thornburg LLP
Barnes & Thornburg LLP
Article

California Passes AB-1883 Targeting AI Workplace Surveillance Of Employees’ Emotional State And Neural Data

On Aug. 30, AB-1883 received final legislative approval and now heads to California Governor Gavin Newsom for signature or veto. If enacted, AB-1883 would prohibit employers from using workplace surveillance tools that rely on artificial intelligence (AI) to recognize, infer, or predict an employee’s emotional state, or to collect “neural data.”
United StatesEmployment and HR
Barnes & Thornburg LLP
Barnes & Thornburg LLP
Article

Russia Sanctions And Tariffs: What Businesses Need To Know About The Graham Act

President Trump has signed the Lindsey O. Graham Sanctioning Russia and Iran Act of 2026, introducing sweeping new tariffs of up to 100% on countries purchasing Russian energy and up to 500% on Russian-origin goods. The legislation also codifies existing executive order sanctions into statute, requiring congressional action to lift restrictions and creating mandatory secondary sanctions on foreign financial institutions transacting with designated Russian banks. Companies face immediate compliance challenge
RussiaInternational Law
Barnes & Thornburg LLP
Barnes & Thornburg LLP
Article

AI May Be The Missing Link To Your Company’s Trade Secret Theft: What In-House Counsel Should Know

As a business and intellectual property attorney, I spend much of my practice helping corporate clients protect and enforce their intellectual property through patents. But patents are not the only game in town. Trade secrets offer an equally valid, and in many cases, a more practical and affordable means of protecting valuable proprietary information, provided a company implements and maintains reasonable protective measures.
United StatesIntellectual Property
Barnes & Thornburg LLP
Barnes & Thornburg LLP
Article

Federal Court Melts USCIS Freeze On Adjudication Of Immigration Benefits For Nationals Of 39 Countries

A federal court has vacated USCIS policies that froze immigration benefit adjudications for nationals of 39 countries under an expanded travel ban, but the State Department's separate pause on immigrant visa issuance for 75 countries remains in effect. Employers must now distinguish between domestic USCIS benefits that can proceed and consular processing that remains suspended when planning for affected workers.
United StatesImmigration
Barnes & Thornburg LLP
Barnes & Thornburg LLP