Preparing For CCPA's Article 9: Data Maps, Retention Schedules, And Cyber Audit Obligations

On May 1, 2025, the California Privacy Protection Agency (CPPA) released updated California Consumer Privacy Act (CCPA) Regulations, emphasizing privacy impact assessments ("risk assessments"), cybersecurity audits, and automated decision-making ("May 2025 Proposed Regulations").

In our prior article, we outlined the need for organizations to begin planning and budgeting in Q3 2025 to meet the significant, long-lead-time requirements. This article aims to thoroughly explore Article 9 of the May 2025 proposed regulations titled "Cybersecurity Audits."

Article 9: Cybersecurity Audits

Under the proposed Article 9, organizations with over $100 million in revenue must complete their first cybersecurity audit report by April 2028. Organizations with between $50 million and $100 million in revenue must complete their first cybersecurity audit report by April 2029, while organizations with less than $50 million in revenue must do so by April 2030.