Independent Cybersecurity Audits Will Be Required For 'Significant Risk' Under CCPA

The California Privacy Protection Agency (CPPA) has unanimously adopted new regulations requiring certain businesses subject to the California Consumer Privacy Act (CCPA) to conduct annual audits of their cybersecurity programs, beginning later this decade.

The new regulations apply to businesses whose processing of personal information presents "significant risk" to consumers' security. This includes businesses that either (i) derive more than 50% of their revenue from selling or sharing personal information or (ii) otherwise meet the CCPA revenue threshold and processed the personal information of at least 250,000 people or the sensitive personal information of at least 50,000 people in the preceding calendar year.