CCPA
CYBERSECURITY
AUDITS
ARE HERE.

The CCPA applies to for-profit businesses that do business in California AND meet at least one threshold: (1) annual gross revenues over $25 million; (2) annually buy, sell, or share personal information of 100,000+ California consumers or households; or (3) derive 50%+ of annual revenue from selling/sharing personal information. Many small businesses fall below these thresholds, but if your business processes significant California consumer data or generates substantial revenue from data sales, you may be covered regardless of size.

No. "Doing business in California" is interpreted broadly. If you have a website accessible to California residents, sell products or services to California consumers, employ California residents, or otherwise conduct commercial activity in California, you likely "do business" in California for CCPA purposes. The law is designed to protect California consumers regardless of where the business is headquartered.

The CCPA (California Consumer Privacy Act) was enacted in 2018 and established foundational privacy rights. The CPRA (California Privacy Rights Act), passed by voters in 2020 as Proposition 24, significantly amended and expanded the CCPA. Key CPRA additions include: creating the California Privacy Protection Agency (CPPA) as a dedicated enforcement body, adding new consumer rights (correction, limiting SPI use), establishing mandatory cybersecurity audit requirements, creating risk assessment obligations, and expanding protections for sensitive personal information. Most practitioners now refer to the combined law as "CCPA/CPRA" or simply "CCPA" as amended.

Primarily yes, though CCPA was originally designed to protect consumers. The CPRA removed the B2B exemption that previously existed, meaning personal information collected in a B2B context (such as employee data or business contact information) is now covered. If your B2B business collects personal information about California residents — including employees, contractors, or business contacts — CCPA obligations apply.

Generally yes. The CCPA applies specifically to "for-profit" businesses. Non-profit organizations are typically exempt. However, some non-profits that operate commercial activities or have significant revenue streams may need to evaluate their status carefully. Additionally, some non-profits voluntarily adopt CCPA-like practices as a best practice.

A CCPA cybersecurity audit is a comprehensive, documented evaluation of your business's security practices, policies, and controls as they relate to the protection of California consumer personal information. It must cover: (1) your data inventory and mapping; (2) risk assessment of threats and vulnerabilities; (3) evaluation of technical and administrative safeguards; (4) vendor and third-party security controls; and (5) incident response capabilities. The audit must be conducted by a qualified professional and documented thoroughly. Results must be retained and made available to the CPPA upon request.

CCPA cybersecurity audits must be conducted annually at minimum. Additionally, businesses must conduct or update their audit whenever there is a "material change" to their data processing activities. Material changes include: launching new products or services that process personal information, significantly changing how you collect or use data, acquiring a new company or dataset, implementing new technology systems that process personal information, or experiencing a significant data security incident.

The CCPA regulations require that cybersecurity audits be conducted by a "qualified, objective, independent professional." For many businesses, this means engaging a third-party cybersecurity firm or qualified security assessor. Internal audits may be acceptable for some purposes, but the independence requirement typically means an external auditor should review the work. The auditor should have relevant credentials such as CISSP, CISM, CISA, or similar cybersecurity certifications, and should have experience with privacy law compliance requirements.

These are two distinct but related requirements. A risk assessment (also called a Privacy Impact Assessment or Data Protection Impact Assessment) focuses on the potential risks and harms to consumers from your data processing activities — it asks "could our data processing harm consumers?" A cybersecurity audit focuses on the adequacy of your security controls protecting consumer data — it asks "are our security measures adequate to protect the data we hold?" Covered businesses must conduct both, and both must be documented and retained.

You are not required to proactively submit your cybersecurity audit to the CPPA. However, you must conduct the audit, document the results, and retain the documentation. The CPPA can request your audit records at any time as part of an investigation or enforcement action. Failure to have documented audit records when requested is itself a compliance violation. Some businesses choose to proactively submit audits to demonstrate good faith compliance.

Discovering gaps is actually the purpose of an audit — you should expect to find areas for improvement. The key is to document the gaps, create a remediation plan with timelines, and actively work to address identified issues. Regulators generally view documented, good-faith remediation efforts favorably compared to businesses that have no audit records at all. The fact that you conducted an audit and are addressing gaps demonstrates a commitment to compliance. Document everything: the gap, the remediation plan, and the resolution.

CCPA penalties are significant: up to $2,500 per unintentional violation and up to $7,500 per intentional violation. Each affected consumer can constitute a separate violation, meaning aggregate penalties can be enormous for large-scale non-compliance. Additionally, the CCPA provides a private right of action allowing California consumers to sue for statutory damages of $100–$750 per consumer per incident (or actual damages if higher) when non-encrypted or non-redacted personal information is subject to unauthorized access due to inadequate security. Class action lawsuits under this provision have resulted in multi-million dollar settlements.

CCPA enforcement is shared between two entities. The California Privacy Protection Agency (CPPA) is the primary enforcement authority, with dedicated staff and broad investigative powers. The California Attorney General also retains enforcement authority. The CPPA can investigate complaints, conduct audits, issue subpoenas, and impose civil penalties. Consumers also have a private right of action for certain data breaches. The CPPA has been actively building its enforcement program and has publicly committed to rigorous enforcement.

Yes. The CPPA has been increasingly active in enforcement. While the agency initially focused on notice and cure procedures for some violations, the cybersecurity audit requirements are subject to direct enforcement without a required cure period for intentional violations. The CPPA has issued enforcement actions, conducted investigations, and made clear that cybersecurity compliance is a priority. Businesses should not assume they will receive advance warning before enforcement action.

No. The cybersecurity audit requirements are currently enforceable, and there is no grace period. Businesses that meet the CCPA thresholds are expected to be in compliance now. The CPPA has been clear that it expects covered businesses to have completed their initial cybersecurity audits and to be on an annual audit cycle. If you have not yet conducted your cybersecurity audit, you should treat this as an urgent compliance priority.

The timeline depends heavily on the size and complexity of your business. For small businesses with straightforward data processing, a basic audit might take 4–8 weeks. For mid-size businesses with multiple systems and vendors, expect 8–16 weeks. Large enterprises with complex data ecosystems may require 6 months or more for a comprehensive initial audit. Subsequent annual audits are typically faster since they build on prior documentation. Starting the process immediately is critical given that enforcement is active.

Costs vary significantly based on business size, complexity, and the auditor engaged. Small businesses might pay $5,000–$25,000 for a basic audit conducted by a qualified consultant. Mid-size businesses typically pay $25,000–$100,000. Large enterprises may spend $100,000–$500,000+ for comprehensive audits. While these costs are significant, they should be weighed against potential penalties: a single enforcement action can dwarf the cost of proactive compliance. Some law firms offer bundled CCPA compliance packages that include audit support.

You must retain: (1) the complete audit report and supporting documentation; (2) evidence of remediation for identified gaps; (3) vendor contracts and Data Processing Agreements; (4) employee training records; (5) incident response records; (6) risk assessment documentation; (7) data inventory and data flow diagrams; and (8) privacy policies and notices. Records should be retained for a minimum of 24 months, though many attorneys recommend longer retention periods. Organize records so they can be quickly produced if the CPPA requests them.

Compliance software tools can be valuable aids for organizing data inventories, managing vendor contracts, and tracking compliance tasks. However, they do not substitute for a formal cybersecurity audit conducted by a qualified professional. The CCPA requires an independent evaluation of your security practices — not just a self-assessment questionnaire. Software tools can help you prepare for and manage the audit process, but the actual audit must be conducted by a qualified human professional who can evaluate your specific systems, controls, and practices.

Yes. Mobile apps that collect personal information from California consumers are subject to CCPA. This includes data collected through the app itself, device identifiers, location data, browsing history within the app, and any other personal information. Mobile apps must have a privacy policy that meets CCPA requirements, provide opt-out mechanisms for data sales/sharing, honor consumer rights requests, and implement appropriate security measures. The cybersecurity audit requirement applies to businesses meeting the thresholds regardless of whether data is collected through a website, app, or other means.

Yes, SaaS companies are squarely within CCPA's scope and often face complex compliance challenges. SaaS companies typically act as both "businesses" (for their own customer data) and "service providers" (when processing data on behalf of their customers). As a business, a SaaS company must comply with all CCPA obligations for data it controls. As a service provider, it must enter into Data Processing Agreements with its customers and only process data as instructed. The cybersecurity audit requirement applies when a SaaS company meets the revenue or data volume thresholds.

Startups below the $25M revenue threshold may still be subject to CCPA if they meet either of the other thresholds — particularly the 100,000 consumer records threshold, which many growing startups meet earlier than they realize. Additionally, even if CCPA does not currently apply, implementing privacy-by-design practices early is far easier than retrofitting compliance later. Investors and enterprise customers increasingly require CCPA compliance regardless of technical applicability. If your startup handles sensitive personal information or is growing quickly, consult with a privacy attorney about your specific situation.

CCPA has specific exemptions for information regulated by HIPAA (Health Insurance Portability and Accountability Act). Personal information that is collected and protected by HIPAA, as well as HIPAA-covered entities and their business associates acting in that capacity, have limited CCPA exemptions. However, these exemptions are not complete — healthcare companies may still have CCPA obligations for non-HIPAA-covered data. The interaction between HIPAA and CCPA is complex, and healthcare companies should work with counsel experienced in both frameworks.

Yes, as of January 1, 2023, the CCPA's employee data exemption expired and full CCPA protections now apply to employee and job applicant personal information. This means California employees have the right to know what personal information their employer collects, the right to delete certain information, and other CCPA rights. Businesses must provide employees with a privacy notice at or before collection, maintain employee data inventories, and handle employee rights requests. This is a significant expansion that many businesses are still working to address.

The most important first step is understanding your current state. Start with a data inventory: document every category of personal information you collect, where it comes from, how you use it, who you share it with, and how long you keep it. This data map is the foundation of both your risk assessment and cybersecurity audit. Next, determine if you meet any CCPA applicability thresholds. Then, engage a qualified attorney and cybersecurity professional to guide your audit process. Download our free CCPA Cybersecurity Audit Checklist as a starting framework.

ReveredLegal, led by attorney Chris W. Hogue, specializes in data privacy and technology law for businesses. The firm offers CCPA compliance packages that include: compliance gap assessments, privacy policy drafting and updates, Data Processing Agreement templates, vendor management frameworks, incident response plan development, and ongoing compliance counsel. With 20+ years of legal experience and a decade as in-house General Counsel for global tech companies, Chris brings practical, business-focused guidance. Contact ReveredLegal at info@reveredlegal.com or (316) 900-3282.

CCPA compliance is definitively an ongoing program, not a one-time project. Requirements include annual cybersecurity audits, regular risk assessments upon material changes, continuous consumer rights request handling, ongoing vendor management, periodic policy updates as laws change, and employee training. The CPPA regularly issues new guidance and may update regulations. Businesses should establish a privacy compliance program with designated responsible parties, regular review cycles, and budget allocation for ongoing compliance activities. Treat CCPA compliance as a business function, not a one-time legal project.