CCPA Risk Assessment: Requirements, Deadlines & Template

A CCPA risk assessment is a written review that a business subject to the California Consumer Privacy Act must complete before it processes personal information.  This review assesses the risks to consumers against the benefits of the processing.

The CCPA risk assessment requirement took effect on January 1, 2026. High-risk processing programs that began before 2026 have until December 31, 2027, to comply.

An advertising pixel on a product page can trigger a CCPA risk assessment because California regulations treat sharing personal information for targeted advertising as a significant privacy risk. 

The CCPA's risk assessment rules are in 11 CCR §§ 7150 to 7157, which were approved by California's Office of Administrative Law on September 22, 2025.

What is a CCPA risk assessment?

A CCPA risk assessment is a decision workflow. Under 11 CCR § 7154, its goal is to restrict or prohibit processing data when the risks to consumers' privacy outweigh the benefits. The benefits counted include those to the consumer, the business, other stakeholders, and the public.

Benefits and negative impacts are the two required elements left out of the definition of the CCPA risk assessment report, the document a business keeps and produces on request. Under 11 CCR § 7001(zz), the report covers the other seven, though the assessment itself still has to identify all nine.

California's term, risk assessment, covers what other privacy regimes call a privacy impact assessment (PIA) or a data protection impact assessment (DPIA): a documented look at a processing activity's privacy risks before it begins.

CCPA risk assessments include cybersecurity audits and rules for automated decision-making technology (ADMT). Cybersecurity audits apply to businesses past the thresholds in 11 CCR § 7120. The ADMT rules cover significant decisions and apply to existing uses from January 1, 2027.

The CCPA compliance checklist covers the requirements in detail.

CCPA risk assessment requirements: the 9 required elements

A CCPA risk assessment has to cover nine elements under 11 CCR § 7152(a):

1. Purpose. The specific reason for the processing. Generic reasons like 'to improve our services' or 'for security purposes' is not allowed.
2. Personal information. The categories processed, sensitive ones included, and the minimum the purpose needs.
3. Operational elements. How and where the data is collected, how long each category is kept, and how the business interacts with consumers. The element also covers roughly how many consumers are involved, what they're told, and which service providers, contractors, or third parties receive the data and why.
4. Benefits. Specific benefits to the business, the consumer, other stakeholders, and the public.
5. Negative impacts. The risks to consumers' privacy, with their sources and causes.
6. Safeguards. The measures the business plans to use against those negative impacts.
7. Decision. Whether the business will go ahead with the processing.
8. Contributors. The people who provided information for the assessment, apart from legal counsel giving legal advice.
9. Approval. The review and approval date, plus the names and positions of the reviewers and approvers, apart from legal counsel giving legal advice.

Negative impacts the regulation asks a business to consider include unauthorized access or disclosure, unlawful discrimination, and weakened control over personal information. 

Safeguards named include encryption, access controls, privacy-enhancing technologies, and advice from outside experts. For ADMT, the company mentions policies and training to prevent unlawful discrimination.

Businesses that need a CCPA risk assessment

A business needs a CCPA risk assessment if it's liable under the law and engages in data processing termed a 'high-risk activity'. Specifically:

• selling or sharing personal information
• processing sensitive personal information, apart from processing employees' or independent contractors' information to administer pay or benefits
• using automated decision-making technology (ADMT) for a significant decision about a consumer
• using automated processing to infer traits such as work performance, health, or behavior
• using automated processing to infer a person's presence at a sensitive location
• processing personal information to train and refine ADMT 
  
  

A for-profit company falls under the CCPA when it does business in California and collects California consumers' personal information. It also has to decide what that information is used for and how, and cross at least one threshold in Civil Code § 1798.140(d):

• gross revenue over $26,625,000 in the prior calendar year, the threshold as adjusted for inflation on January 1, 2025
• buying, selling, or sharing personal information about 100,000 or more California consumers or households each year
• half or more of annual revenue coming from selling or sharing personal information

ADMT means technology that processes personal information and uses computation to replace human decision-making, or substantially replace it. A significant decision is one that results in providing or denying financial or lending services, housing, education enrollment or opportunities, employment or contracting opportunities or pay, or healthcare services.

An example of a business requiring a CCPA risk assessment: dating apps that pass users' precise location, ethnicity, and medical details to their analytics service provider need one.

So does an employer that plans to record job interviews and use emotion-recognition software, with no human involvement, to decide whom to hire.

Under 11 CCR § 7001(v), government agencies and many nonprofits aren't liable under the CCPA, so the risk assessment doesn't reach them either.

When website advertising triggers a CCPA risk assessment

Website advertising requires a CCPA risk assessment when it involves selling or sharing personal information, the first of the six triggers. Under Civil Code § 1798.140(ah), sharing means disclosing personal information to a third party for cross-context behavioral advertising, whether or not money changes hands.

Cross-context behavioral advertising targets ads at a person based on their activity across other businesses or websites, apps, or services.

A retargeting pixel fits that definition when it passes a visitor's browsing data to an ad platform that then shows the visitor ads on other sites.

CalPrivacy has described ad tech in the same terms in its enforcement actions. Its 2025 order against American Honda says Honda sold, shared, or disclosed website visitors' personal information to advertising technology companies, which used it to track consumers across websites. 

For example, a personal-budgeting app plans to show its users payday-loan ads on other websites, based on what their financial data says about them. That plan involves sharing data with third-parties, triggering a risk assessment.

CCPA risk assessments for employers 

AI hiring tools can trigger the ADMT definition, which impacts employers. Under 11 CCR § 7001(e), a tool substantially replaces human decision-making when its output is used to decide outcomes fully automated.

Human involvement means a reviewer who can interpret the output, analyze it with other relevant information, and has authority to change the decision.

Under 11 CCR § 7001(eee), systematic observation is regular or continuous, such as video or audio recording or location tracking. Software that scores call-center agents' performance from recorded calls fits that trigger, with or without a human reviewer.

How to weigh the risks against the benefits

The CCPA's risk assessment rules require a business to weigh risks against benefits but don't specify a method. A common one, described in the EDPB's DPIA template explainer, rates each risk by likelihood and severity. Applied to California's test, it works in three passes:

1. Each negative impact gets a rating of low, medium, or high for likelihood, and another for severity.
2. Each one is rated again with the planned safeguards in place, and that residual rating is the one that counts.
3. The residual risks are set against the specific benefits, with a record of why one side outweighs the other.

A high residual risk calls for restricting the processing first: collecting less, keeping data for less time, dropping a recipient, or leaving out sensitive data. If the risks still outweigh the benefits, 11 CCR § 7154 points to prohibiting the processing.

How to conduct a CCPA risk assessment, with a template

A CCPA risk assessment starts with finding the data processing that triggers one and ends with the summary filing to CalPrivacy. The regulations don't name a process owner, but the filing implies that the executive who signs the attestation must be directly responsible for risk-assessment compliance.

Format and length are up to the business, but the content has to hold up if a regulator demands the full report. A retargeting pixel needs a short report, while an ADMT hiring system needs a longer one, because its logic and outputs must also be documented.

These eight steps cover the work required:

1. Gate new launches. New ad tags, vendors, AI tools, and HR systems go through a trigger check before they go live, and the answer is recorded. Output: an intake record.
2. Confirm coverage and find the triggers. The business checks the CCPA thresholds, then lists every processing activity and matches each one against the six triggers. Output: a trigger inventory.
3. Group similar processing. One assessment can cover a comparable set of activities that present similar risks, under 11 CCR § 7156(a). Output: a list of assessments to run.
4. Bring in the people who run it. Employees involved in the processing contribute, and service providers supply the facts they hold. Output: a contributor list.
5. Fill in the nine elements. Specific purposes and benefits, the minimum data needed, and named recipients go into the report. Output: a draft report.
6. Weigh risks against benefits and decide. Each negative impact is rated before and after safeguards, and the residual risks are set against the benefits. Output: a recorded decision.
7. Get approval from someone with a say. Someone with authority to take part in deciding whether the processing starts reviews and approves the assessment. Output: a signed approval.
8. Keep, review, and file. The business stores each version, sets the three-year review date, updates the assessment within 45 days of a material change, and adds it to the next April 1 submission. Output: a version history and a filing tally.

Most of the example's safeguards are duties the CCPA already places on any business that shares personal information. The CCPA compliance checklist covers those duties, including how to honor Global Privacy Control.

Free GDPR templates can be a starting point, such as the ICO's sample DPIA template and the EDPB's 2026 draft template. An assessment built on either still needs California's own elements, such as the minimum data needed, the go-ahead decision, and the authorized approver.

CCPA risk assessment vs GDPR DPIA and other state assessments

A CCPA risk assessment shares its structure with a GDPR data protection impact assessment (DPIA) and with Virginia's and Colorado's data protection assessments:

What happens if a business skips a CCPA risk assessment?

A business that skips a required CCPA risk assessment faces fines of up to $2,663 per violation, or $7,988 for intentional violations and violations involving the personal information of consumers the business knows are under 16. Those are the inflation-adjusted amounts in effect since January 1, 2025.

CalPrivacy issues administrative fines under Civil Code § 1798.155. The Attorney General seeks civil penalties under § 1798.199.90, whose higher tier also covers violations involving minor consumers.

The attestation also puts an individual on record: the executive who signs it declares under penalty of perjury that the submitted information is true and correct. CalPrivacy or the Attorney General can demand the full reports at any time, with 30 calendar days to produce them.

Who must take part in a CCPA risk assessment

Employees whose jobs include the processing being assessed must take part in a CCPA risk assessment, under 11 CCR § 7151. The person who decides how the data will be collected, for example, must provide that information to whoever runs the assessment.

Outside parties are optional in a CCPA risk assessment. A business may involve service providers, contractors, experts in detecting bias in ADMT, a sample of the affected consumers, or consumer advocacy groups.

Service providers and contractors owe a business their own cooperation, under 11 CCR § 7050(h). For personal information collected under its contract, they must supply the facts its risk assessment needs and not misrepresent any of them. A contract may also require that help, under 11 CCR § 7051(a)(5).

A SaaS company often stands on both sides of that duty. It asks its own vendors for facts, and as a service provider it owes its customers the facts their assessments need.

CCPA risk assessment deadlines

A CCPA risk assessment is due before any new high-risk processing starts, and by December 31, 2027 for high-risk processing that began before 2026. After that, deadlines come from routine reviews, material changes to the processing, and filings with CalPrivacy.

How Enzuzo helps with a CCPA risk assessment

Enzuzo supports two safeguards that s a CCPA risk assessment usually includes: recording consent of each website visitor and storing that choice for audits. 

Enzuzo's CCPA compliance software can create an opt-out page that lets visitors opt out or ask for their personal information, and its consent manager keeps a record of each visitor's consent preferences. On Pro and Enterprise plans, Enzuzo can detect a visitor's Global Privacy Control signal and automatically opt them out of non-essential services and cookies once GPC support is turned on.

Enzuzo doesn't write or file risk assessments. Weighing the risks, signing off, and submitting the summary to CalPrivacy are tasks for the business and its counsel.

Book a demo to see what a consent flow would look like on your site.

Frequently asked questions

Is a CCPA risk assessment the same as a privacy impact assessment?

A CCPA risk assessment does the job of a privacy impact assessment (PIA): it documents a processing activity's privacy risks and how the business will address them. California's version requires a recorded decision on whether to proceed, named approvers, and a summary filing with CalPrivacy.

When is the CCPA risk assessment deadline?

CCPA risk assessments for high-risk processing that began before 2026 are due by December 31, 2027. High-risk processing that starts in 2026 or later needs its assessment before it begins.

Do businesses have to submit risk assessments to CalPrivacy?

Businesses file a summary of their CCPA risk assessments, not the full reports, with the California Privacy Protection Agency, now called CalPrivacy. Each summary carries an executive's signed attestation. Full reports go to CalPrivacy or the Attorney General only on request, within 30 calendar days.

Do advertising pixels require a CCPA risk assessment?

Advertising pixels require a CCPA risk assessment when they sell or share personal information, for example by sending it to a third party for cross-context behavioral advertising. Retargeting visitors on other websites is the typical case, and the business must also be covered by the CCPA. A measurement-only pixel can still be a sale if its provider receives the data as a third party for its own use.

How often does a CCPA risk assessment need to be updated?

A CCPA risk assessment needs a review at least once every three years and an update within 45 calendar days of any material change. A change is material when it adds negative impacts, makes existing ones more likely or severe, or weakens the safeguards. Each version must be kept while the processing continues, or for five years after completion if that's longer.