Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 02 JULY 2025

Preparing For CCPA's Proposed Article 10: Risk Assessments And Certification Mandates

Ankura Consulting Group LLC
Explore more from Ankura Consulting Group LLC

On May 1, 2025, the California Privacy Protection Agency (CPPA) issued revised California Consumer Privacy Act (CCPA) Regulations, focusing on privacy impact assessments...

United StatesPrivacy
Ankura Consulting Group LLC
Ankura Consulting Group LLC
Colleen M. Yushchak
Colleen M. Yushchak

On May 1, 2025, the California Privacy Protection Agency (CPPA) issued revised California Consumer Privacy Act (CCPA) Regulations, focusing on privacy impact assessments (risk assessments), cybersecurity audits, and automated decision-making (May 2025 Proposed Regulations).

In our previous articles, we emphasized the necessity of initiating planning and budgeting by Q3 2025 to address the substantial, long-term compliance requirements of the May 2025 Proposed Regulations. Additionally, we provided an in-depth exploration of Article 9, "Cybersecurity Audits," contained within these regulations.

This article aims to thoroughly explore the compliance requirements of Article 10 of the May 2025 Proposed Regulations titled "Risk Assessments."

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

SB 54 Is In Effect: What California’s New Packaging Law Means For Your Business

Although being challenged by an injunction filed on August 20, 2026, by a coalition of 17 states, California’s SB 54 Plastic Pollution Prevention and Packaging Producer Responsibility Act is now in effect, and companies that sell, distribute, import, or ship packaged products into California should be evaluating whether they have compliance obligations.
United StatesPrivacy
Wilson Elser Moskowitz Edelman & Dicker LLP
Wilson Elser Moskowitz Edelman & Dicker LLP
Article

California’s 2026 Legislative Session Wraps: A Wave Of Privacy And AI Bills Reaches The Governor, With Key Child Safety And AI Measures Signed Into Law

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?
United StatesPrivacy
Kelley Drye & Warren LLP
Kelley Drye & Warren LLP
Article

California's Fall 2026 Privacy Roundup: Expanded CCPA Deletion Rights And More

California Governor Gavin Newsom has signed several significant privacy bills that will reshape how businesses handle consumer data, including expanded deletion rights under the CCPA, shortened data broker response cycles, and sweeping new insurance sector privacy requirements. While one landmark bill banning the sale of sensitive personal information was vetoed, the approved legislation requires companies to update their deletion workflows...
United StatesPrivacy
McDermott Will & Schulte
McDermott Will & Schulte
Article

The Data Breach Brief: Week Of September 30th, 2026

Multiple organizations have recently disclosed significant data breaches affecting thousands of individuals, with compromised information ranging from basic contact details to highly sensitive medical records and financial data. The incidents span various sectors including healthcare, insurance, and professional services, raising questions about the scope of exposure and potential remedies for affected individuals.
United StatesPrivacy
Morgan & Morgan
Morgan & Morgan
Article

Emerging Enforcement Trends In Digital Health Data Privacy: Lessons From Washington’s My Health My Data, FTC vs. Hims & Hers And UCHealth Enforcement Actions

Federal and state regulators are intensifying scrutiny of healthcare and digital health companies over tracking technologies that share sensitive patient data with advertising platforms. Recent enforcement actions against major telehealth providers and healthcare systems reveal how common marketing practices can trigger significant legal liability under privacy laws, even for organizations not covered by HIPAA.
United StatesPrivacy
Benesch, Friedlander, Coplan & Aronoff LLP
Benesch, Friedlander, Coplan & Aronoff LLP
Article

Eleventh Circuit Developments: Decisions On Florida And Georgia Social Media/Minor Laws And New Alabama Law

Legal risk intensifies for companies offering online interactive features to minors across Georgia, Florida, and Alabama as the Eleventh Circuit vacates preliminary injunctions against state social media laws. With Florida's HB 3 and Georgia's SB 351 now enforceable and Alabama's HB 161 set to take effect January 1, 2027, businesses face divergent compliance requirements including age verification, parental consent mechanisms, and account deletion protocols.
United StatesPrivacy
Taft, Stettinius & Hollister LLP
Taft, Stettinius & Hollister LLP
Article

Ankura CTIX FLASH Update – September 22, 2026

This collection of insights from Ankura explores critical challenges facing multiple industries in 2026, from cybersecurity threats targeting AI assistants to the evolving landscape of freight capacity, cryptocurrency enforcement, and healthcare compliance. The articles examine how organizations navigate regulatory complexity, operational constraints, and emerging risks across financial services, logistics, healthcare, and technology sectors.
United StatesStrategy
Ankura Consulting Group LLC
Ankura Consulting Group LLC
Article

Following The Funds: What Recent Crypto Enforcement Actions Reveal About Sanctions Evasion And Financial Crime Controls

This collection showcases Ankura's latest insights spanning cryptocurrency enforcement, parcel shipping costs, sanctions compliance, cybersecurity threats, mortgage industry dynamics, healthcare labor challenges, AI governance in financial services, and business transformation strategies. Each piece examines critical operational and regulatory challenges facing organizations across multiple sectors, offering strategic perspectives on navigating complex business environments.
GlobalCorporate/Commercial Law
Ankura Consulting Group LLC
Ankura Consulting Group LLC
Article

Ankura CTIX FLASH Update – September 15, 2026

Ankura's latest insights explore how organizations can transform data and analytics investments into actionable business value through decision intelligence, while addressing critical challenges in AI workforce readiness, cybersecurity threats, and regulatory compliance across multiple industries. The collection examines emerging opportunities in stablecoin regulation, healthcare data optimization, and procurement efficiency.
United StatesStrategy
Ankura Consulting Group LLC
Ankura Consulting Group LLC
Article

Ankura CTIX FLASH Update – September 28, 2026

Ankura's latest insights explore critical developments across cybersecurity, supply chain disruption, healthcare compliance, and financial crime enforcement. From AI-driven malware threats and tariff-induced supply chain reconfigurations to evolving cryptocurrency sanctions enforcement and clinical trial participant support regulations, these analyses examine how organizations navigate operational, regulatory, and strategic challenges in an increasingly complex risk landscape.
United StatesStrategy
Ankura Consulting Group LLC
Ankura Consulting Group LLC