Who Must Conduct a CCPA Audit?
Under CPRA regulations, businesses must conduct annual cybersecurity audits if their processing of personal information presents significant risk to consumers' privacy or security. The CPPA's regulations identify high-risk processing activities that trigger the audit requirement, including processing personal information of 100,000 or more consumers annually.
"Businesses that process personal information of 100,000+ California consumers annually are among those required to conduct annual CCPA cybersecurity audits — and must submit audit results to the CPPA upon request."
What a CCPA Audit Must Cover
A CCPA audit must assess the business's security practices against the risks to consumers' personal information. The audit must be conducted by a qualified, independent auditor and must evaluate:
- Technical security measures (encryption, access controls, network security)
- Administrative safeguards (policies, training, vendor management)
- Physical security controls
- Data retention and deletion practices
- Consumer rights fulfillment processes
- Incident response and breach notification procedures
"A CCPA audit is not a one-time exercise — it must be conducted annually, with findings documented and remediation plans implemented within 90 days of identifying material deficiencies."