ControlCase

IT Certifications, Continuous Compliance and Cybersecurity Services Provider

CCPA

California Consumer Privacy Act of 2018 (CCPA),
as amended by the California Privacy Rights Act of 2020 (CPRA)

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), is California’s comprehensive consumer privacy law. The CCPA Regulations effective January 1, 2026 add risk-based requirements for specified processing, including privacy risk assessments, annual cybersecurity audits for qualifying businesses, and consumer rights and notice requirements for certain uses of automated decisionmaking technology (ADMT). ControlCase provides one integrated CCPA/CPRA assessment that helps organizations determine applicability, validate privacy and security controls, test consumer-rights processes, identify processing that triggers an Article 10 privacy risk assessment, and complete the risk assessment where required. The CCPA is a legal obligation, not a certification.

Schedule a Consultation

Assess Once, Comply to Many

Clear Applicability and Scope

Determine whether the CCPA applies and which additional requirements - privacy risk assessments, ADMT requirements, or cybersecurity audits - are triggered by the organization’s data processing, business model, and scale.

Evidence-Based Privacy Validation

Test applicable notices, consumer-rights workflows, sale/sharing opt-outs, sensitive personal information controls, opt-out preference signals, retention practices, service-provider/contractor/third-party governance, and supporting technical evidence rather than relying on policy review alone.

Integrated Privacy Risk Assessment

Where Article 10 is triggered, evaluate the covered processing, benefits, negative privacy impacts, safeguards, processing decision, required approvals, lifecycle requirements, and applicable CalPrivacy submission information as part of the same engagement.

Evidence Reuse Across Frameworks

Reuse applicable evidence from PCI DSS, ISO 27001, SOC 2, NIST CSF 2.0, GDPR, and other programs through ControlCase One Audit™, while maintaining CCPA-specific conclusions and deliverables.

What is the CCPA/CPRA?

What is the CCPA/CPRA?

The CPRA amended and expanded the CCPA; it did not create a separate parallel privacy law or compliance framework. The CCPA gives California residents rights to know, delete, correct, opt out of the sale or sharing of personal information, limit certain uses and disclosures of sensitive personal information, and receive non-discriminatory treatment for exercising CCPA rights. Covered businesses must provide required notices and operate processes that make applicable rights effective.

The regulations effective January 1, 2026, implement three important risk-based areas: privacy risk assessments for specified significant-risk processing; annual cybersecurity audits for businesses meeting the Article 9 thresholds; and pre-use notice, access, and opt-out requirements for businesses using ADMT to make significant decisions, subject to applicable exceptions. ADMT compliance begins January 1, 2027. These requirements apply only when their specific triggers are met.
Current CCPA business threshold (as of September 2026) - A for-profit entity doing business in California that determines the purposes and means of processing personal information is generally a CCPA “business” if it meets at least one statutory threshold: (1) more than $26.625 million in gross annual revenue for the preceding calendar year (current CPI-adjusted amount); (2) annually buys, sells, or shares the personal information of 100,000 or more consumers or households; or (3) derives 50% or more of annual revenue from selling or sharing consumers’ personal information. Certain controlled/common-branding entities, joint ventures or partnerships, and voluntarily certified entities may also be covered, and service providers and contractors have separate CCPA obligations. Applicability should be confirmed for each legal entity and data flow.

Who Should Consider a CCPA/CPRA Assessment?

  • For-profit organizations doing business in California that meet, or may meet, a CCPA business threshold.
  • Organizations processing personal information of California customers, employees, job applicants, independent contractors, or business contacts and needing to validate operational compliance.
  • Businesses that sell or share personal information, process sensitive personal information, use ad-tech or profiling, use ADMT for significant decisions, or rely on complex service-provider and third-party ecosystems.
  • Organizations preparing for a CCPA privacy risk assessment or for the phased annual cybersecurity audit requirement.

Why Choose ControlCase for CCPA/CPRA Assessment?

One Audit™ Approach
Map CCPA requirements to common controls and reuse applicable evidence across PCI DSS, NIST CSF 2.0, ISO 27001, SOC 2, GDPR, and other frameworks while preserving CCPA-specific conclusions.
Privacy and Technical Testing
Combine governance and documentation review with end-to-end testing of consumer-rights workflows, opt-out preference signal handling, website/app controls, data retention and deletion, vendor controls, and relevant security controls.
Compliance Hub Visibility
Centralize evidence requests, requirement mappings, findings, remediation status, risk-assessment records, and collaboration within ControlCase Compliance Hub.
Integrated Risk-Based Service Model
Use one applicability and assessment process to determine whether Article 10 privacy risk assessment work is required and complete it within the same engagement, while separately identifying ADMT and Article 9 cybersecurity-audit obligations. Independent Article 9 audit work remains subject to the regulation’s auditor-independence requirements.

What Does the Integrated CCPA/CPRA Assessment Cover?

Area 1
Applicability & Governance

Entity thresholds, roles, accountability, data-level exemptions, policies, training, records, and governance.

Area 2
Data Inventory & Purpose Limitation

PI/SPI inventories, data flows, purpose limitation, reasonable necessity/proportionality, minimization, and retention.

Area 3
Notices & Consumer Rights

Notice at Collection, privacy policy, rights to know, delete, correct, limit (where applicable), and non-discrimination.

Area 4
Sale / Sharing & Preference Signals

Do Not Sell or Share mechanisms, Global Privacy Control / other qualifying opt-out preference signals, status display, consent and financial-incentive interactions.

Area 5
Service Providers & Third Parties

Required contracts, use restrictions, due diligence, monitoring/verification rights, downstream obligations, and vendor oversight.

Area 6
Reasonable Security

Security governance and safeguards relevant to personal information; identify whether the separate Article 9 cybersecurity-audit trigger applies.

Area 7
Privacy Risk Assessment

Identify Article 10 triggers and, when required, assess processing purpose, minimum PI necessary, operations, retention, consumers affected, disclosures, benefits, negative privacy impacts, safeguards, contributors, approval, processing decision, and lifecycle/submission requirements.

Area 8
ADMT

Identify qualifying ADMT used to make significant decisions and assess pre-use notice, access, opt-out (subject to regulatory exceptions), appeal where applicable, linked risk-assessment, and related requirements.

ControlCase Integrated CCPA/CPRA Assessment Process

STEP 01
Applicability and Scoping
Confirm legal entities, CCPA business thresholds, California resident populations, PI/SPI, systems, data flows, service providers/contractors/third parties, statutory exemptions or data carve-outs, and whether Article 10, ADMT, or Article 9 cybersecurity-audit triggers apply.
STEP 02
Evidence Planning and Data Discovery
Map applicable requirements, issue targeted evidence requests, and review inventories, notices, policies, contracts, consumer-rights records, retention practices, technical configurations, and processing activities that may require a privacy risk assessment.
STEP 03
Assessment, Interviews, and Trigger Analysis
Interview privacy, legal, HR, marketing, security, IT, procurement, product, and other responsible teams; assess control design and operation; and confirm whether any in-scope processing triggers Article 10.
STEP 04
Operational, Technical, and Risk Validation
Test selected rights workflows, opt-out preference signal behavior, vendor controls, retention/deletion processes, and relevant privacy/security evidence. Where Article 10 applies, evaluate the processing purpose, benefits, negative privacy impacts, safeguards, and required processing decision.
STEP 05
Findings, Risk Treatment, and Reporting
Provide requirement-level conclusions, prioritized gaps, remediation actions, owners, and target dates. For required privacy risk assessments, document the assessment, contributors, approval, safeguards, and decision to initiate or continue processing.
STEP 06
Validation, Submission Support, and Lifecycle Management
Retest remediation where included, support preparation of applicable section 7157 information and executive attestation, and establish material-change monitoring, three-year risk-assessment review dates, and ongoing compliance tracking.
STEP 01
Applicability and Scoping
Confirm legal entities, CCPA business thresholds, California resident populations, PI/SPI, systems, data flows, service providers/contractors/third parties, statutory exemptions or data carve-outs, and whether Article 10, ADMT, or Article 9 cybersecurity-audit triggers apply.
STEP 02
Evidence Planning and Data Discovery
Map applicable requirements, issue targeted evidence requests, and review inventories, notices, policies, contracts, consumer-rights records, retention practices, technical configurations, and processing activities that may require a privacy risk assessment.
STEP 03
Assessment, Interviews, and Trigger Analysis
Interview privacy, legal, HR, marketing, security, IT, procurement, product, and other responsible teams; assess control design and operation; and confirm whether any in-scope processing triggers Article 10.
STEP 04
Operational, Technical, and Risk Validation
Test selected rights workflows, opt-out preference signal behavior, vendor controls, retention/deletion processes, and relevant privacy/security evidence. Where Article 10 applies, evaluate the processing purpose, benefits, negative privacy impacts, safeguards, and required processing decision.
STEP 05
Findings, Risk Treatment, and Reporting
Provide requirement-level conclusions, prioritized gaps, remediation actions, owners, and target dates. For required privacy risk assessments, document the assessment, contributors, approval, safeguards, and decision to initiate or continue processing.
STEP 06
Validation, Submission Support, and Lifecycle Management
Retest remediation where included, support preparation of applicable section 7157 information and executive attestation, and establish material-change monitoring, three-year risk-assessment review dates, and ongoing compliance tracking.

Do You Know Which CCPA/CPRA Requirements and Privacy Risk Assessments Apply to Your Business?

Book Expert Time
Chat with an Advisor Available now
Chat with our representative
Compliance Advisor
Compliance Advisor HUMAN · LIVE
Online now · Replies within 2 minutes
Privacy Policy
Powered by HubSpot