California Risk Assessments: Seven Steps For Employers

At a Glance

• Many employers may need to start now on conducting the new risk assessments required by the California Consumer Privacy Act
• These risk assessments will require substantial fact-gathering, time, and involvement from employees across the company
• The following article provides seven key steps on completing the risk assessments within the deadlines

Effective January 1, 2026, the California Consumer Privacy Act (CCPA) requires certain employers to complete detailed, documented risk assessments before engaging in many routine data processing practices. Because the assessments must be finalized before Covered Processing begins—and because they must include the date of approval and the names of reviewers—employers cannot wait to “backfill” assessments later. The California attorney general and California privacy agency (“CalPrivacy”) may also request copies at any time.