The California Consumer Privacy Act is usually treated as a legal project: a privacy policy, a cookie banner, a web form. Those matter. But most of the real work, and most of the real exposure, sits in IT, in knowing where personal data lives, being able to find and delete it on request, and keeping it secure enough that a breach does not become a lawsuit.
That split became sharper on 1 January 2026, when new regulations from the California Privacy Protection Agency took effect adding cybersecurity audits and risk assessments for higher-risk businesses. This guide covers who the law applies to, what changed, and the IT work in a sensible order.
It is a practical summary, not legal advice. Confirm your own obligations with counsel.
Who the Law Actually Covers
The CCPA applies to for-profit businesses that do business in California and meet at least one of three thresholds:
Revenue. Annual gross revenue above $26,625,000. This was $25 million until the Consumer Price Index adjustment that took effect on 1 January 2025.
Volume. Buying, selling or sharing the personal information of 100,000 or more California consumers or households each year.
Business model. Deriving half or more of annual revenue from selling or sharing personal information.
Two points catch people out. First, the revenue test counts total revenue, not California revenue, so a mid-sized company headquartered elsewhere with a handful of California customers can still be covered. Second, since January 2023 the law has applied in full to employee, applicant and business-contact data, so an HR file is personal information in exactly the same way a customer record is.
What Changed in January 2026
The Office of Administrative Law approved the CPPA’s new regulations on 23 September 2025, and they took effect on 1 January 2026. Three additions matter for IT.
Cybersecurity audits. Businesses whose processing presents a significant risk to consumers’ security must complete an annual, independent cybersecurity audit and certify it to the agency. The trigger is broadly half of revenue from selling or sharing personal information, or meeting the revenue threshold while processing the personal information of 250,000 or more consumers, or the sensitive personal information of 50,000 or more.
Risk assessments. Businesses carrying out higher-risk processing, such as selling or sharing personal information or processing sensitive data, must document a risk assessment. Assessments for processing already underway are due by 31 December 2027 and submitted by 1 April 2028.
Automated decision-making. Rules for automated decision-making technology used in significant decisions apply from 1 January 2027.
| Your annual gross revenue | First cybersecurity audit certification due |
|---|---|
| Over $100 million (based on 2026) | 1 April 2028 |
| $50 to $100 million (based on 2027) | 1 April 2029 |
| Under $50 million (based on 2028) | 1 April 2030 |
After the first certification, audits are annual. The regulations spell out what the audit must examine, and most of it is ordinary security hygiene: authentication, encryption, access controls, logging, patching, backups and incident response.
Where the Obligations Land on IT
A data map
You cannot answer an access or deletion request for data you cannot find. That means an inventory of where personal information sits: Microsoft 365, the CRM, the file server, the HR platform, backups and every vendor that receives a copy.
Access and deletion requests
Covered businesses must verify the requester, then search every system on the map and respond, generally within 45 days. Doing that by hand across a dozen systems is where most small programmes break down.
Reasonable security
The breach lawsuit provision turns on a failure to maintain reasonable security, and it applies to unencrypted, unredacted data. MFA, encryption, patching and logging are the everyday controls that decide whether a breach stays an incident or becomes a claim.
Service provider contracts
Anyone processing personal information on your behalf needs a contract with the terms the law requires. IT usually knows the full list of tools in use better than anyone else does.
The Penalties, in Plain Numbers
| Exposure | Amount at 2025 adjusted levels |
|---|---|
| Administrative fine, per violation | Up to $2,663 |
| Intentional violation, or involving a consumer under 16 | Up to $7,988 |
| Private action after a breach, per consumer per incident | $107 to $799 |
The per-consumer figure is the one that scales. A breach touching 20,000 California records multiplies quickly, which is why the private right of action, not the regulator, is the real financial risk for most mid-sized businesses. The amounts are adjusted for inflation every two years.
Not sure which thresholds you meet? Start with revenue and a rough count of California records across customers, employees and contacts. That usually settles coverage in an afternoon and tells you whether the 2026 audit rules could apply.
A Sensible Order of Work
- Settle coverage. Check the three thresholds, and separately whether the cybersecurity audit and risk assessment triggers could apply to you.
- Build the data map. List every system and vendor that holds personal information, what categories it holds and who can access it.
- Close the obvious security gaps. MFA everywhere, encryption for laptops and sensitive stores, patching, and logging you can actually retrieve. A security risk assessment gives you the prioritised list.
- Make requests repeatable. A written process for verifying and answering access and deletion requests, with a named owner and a way to search every mapped system.
- Tie it to a programme. If you already work toward another framework, fold the CCPA work into it rather than running it separately. Our compliance services are built around exactly that.
CCPA Questions, Answered
Related reading: Penetration Testing Cost · Dark Web Monitoring for Business · Employee Offboarding: What IT Must Do
Want to Know Where Your Gaps Are?
We map where personal data sits in your environment, check the controls that matter for the reasonable-security test, and give you a prioritised list. Start with a readiness review or book a call.