CCPA and CPRA Compliance Services: Readiness, Risk Assessments, and Independent Cybersecurity Audits
CCPA compliance readiness for businesses that handle personal information of California residents, wherever they are based. We test your notices, opt-outs, consumer requests, and vendor contracts against the California Consumer Privacy Act, as amended by the CPRA, and the CalPrivacy regulations in force since 1 January 2026. We can also perform the independent cybersecurity audit the new regulations require. Most readiness assessments take 6–12 weeks.
What Is CCPA and CPRA Compliance?
CCPA compliance means meeting the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA), and the regulations issued by the California Privacy Protection Agency, now known as CalPrivacy. Businesses must tell people what they collect, honor requests to know, delete, and correct, let people opt out of the sale or sharing of their data, limit the use of sensitive data, and keep personal information reasonably secure.
The CCPA applies to for-profit businesses that do business in California and meet any one of three tests: annual gross revenue above $26,625,000; buying, selling, or sharing the personal information of 100,000 or more California consumers or households; or earning half or more of annual revenue from selling or sharing personal information. Location does not matter. A company in Texas, London, or Bangalore with enough California customers is in scope, and employee and job applicant data are covered too.
Accredify Global assesses where you stand and tests the processes behind your privacy policy. For businesses that must complete a CCPA cybersecurity audit, we can act as the independent auditor. To stay independent, we do not design or run the program we audit.
CCPA in 2026: Cybersecurity Audits, Risk Assessments, and Automated Decisions
New regulations have applied since 1 January 2026. California finalized them in September 2025. They add three duties: risk assessments for high-risk processing, yearly cybersecurity audits for larger or data-heavy businesses, and rules for automated decisionmaking technology (ADMT) used for significant decisions.
The deadlines are staggered. Risk assessments apply to new high-risk processing now. Processing that began before 2026 needs an assessment by 31 December 2027, and a summary goes to CalPrivacy by 1 April 2028. ADMT duties apply from 1 January 2027. The first cybersecurity audit certifications are due on 1 April 2028 for businesses with revenue above $100 million, 2029 for $50–100 million, and 2030 for the rest.
Enforcement is active. CalPrivacy and the Attorney General have announced a run of settlements, and the agency's Delete Request and Opt-out Platform (DROP) now binds data brokers, which must process its deletion requests from 1 August 2026. A separate law, SB 446, has required breach notices to Californians within 30 days of discovery since 1 January 2026.
Sources: CalPrivacy: regulations finalized · Staggered deadlines (Hunton) · Cybersecurity audit rules (Faegre Drinker) · CPI-adjusted thresholds · SB 446 breach notice (NLR)
CCPA Requirements, and What We Assess
The duties CalPrivacy and the Attorney General check most, and the evidence our assessment looks for.
| Obligation | What the law expects | Evidence we look for |
|---|---|---|
| Notice at collection and privacy policy | Tell people what you collect, why, how long you keep it, and who receives it | Notices that match your real data flows and retention |
| Opt-out of sale or sharing | A "Do Not Sell or Share" link and honoring opt-out preference signals such as Global Privacy Control | Live tests of the link, the signal, and what stops afterwards |
| Sensitive personal information | Limit its use when it goes beyond what the law allows | A sensitive data inventory and a working "Limit" option where needed |
| Requests to know, delete, and correct | Respond within 45 calendar days, extendable once by 45 more | Request logs, identity checks, and response times |
| Vendor contracts | Required terms for service providers, contractors, and third parties | Contracts that contain the terms, and oversight that applies them |
| Reasonable security | Security suited to the nature of the personal information | Controls in place and tested; breaches can lead to lawsuits |
| Risk assessments | Before high-risk processing, such as selling data, using sensitive data, or ADMT for significant decisions | Completed assessments and the summary due to CalPrivacy |
| Automated decisionmaking | Pre-use notice, opt-out, and access rights for significant decisions | An ADMT inventory and the notices and opt-outs behind it |
CCPA Cybersecurity Audits: Who Needs One and What It Covers
A yearly, evidence-based audit of your cybersecurity program, signed by an independent auditor and certified to CalPrivacy by one of your executives.
Who must complete an audit
- Businesses earning half or more of yearly revenue from selling or sharing personal information
- Businesses above the revenue threshold that processed personal information of 250,000 or more consumers or households in the prior year
- Businesses above the revenue threshold that processed sensitive personal information of 50,000 or more consumers
| Revenue over $100 million | First certification due 1 April 2028 |
|---|---|
| $50–100 million | First certification due 1 April 2029 |
| Under $50 million | First certification due 1 April 2030 |
The areas the auditor assesses, where they apply
- Authentication, account management, and access controls
- Encryption of personal information at rest and in transit
- Inventory of personal information and information systems
- Secure configuration, limited ports, services, and protocols
- Vulnerability scans, penetration testing, and disclosure programs
- Audit logs, network monitoring, segmentation, and anti-malware
- Security awareness, training, and secure development
- Oversight of service providers, contractors, and third parties
- Retention schedules and secure disposal
- Incident response, business continuity, and backups
Findings must rest on evidence the auditor examined, not on management's word. The auditor must be qualified and independent, and must report to someone who is not responsible for the cybersecurity program. An assessment done for another purpose can be reused if it meets these rules, which is why an existing ISO 27001 audit, SOC 2 report, or NIST CSF assessment is a useful starting point. Penetration testing evidence can come from a VAPT engagement.
CCPA Deadlines, Fines, and Breach Lawsuits
Fines count per violation, so one broken opt-out applied to thousands of visitors adds up quickly.
Clocks your team must meet
| Requests to know, delete, correct | 45 calendar days, extendable once by 45 more |
|---|---|
| Opt-out of sale or sharing | As soon as feasible, and no later than 15 business days |
| Data breach notice | To affected Californians within 30 days of discovery (SB 446) |
| Attorney General | A sample notice within 15 days of notifying consumers, if more than 500 residents are affected |
Penalties and damages
- Up to $2,663 per violation in administrative fines or civil penalties
- Up to $7,988 per intentional violation, or any violation involving consumers under 16
- $107 to $799 per consumer per incident, or actual damages, in lawsuits after a breach caused by unreasonable security
- Orders to change practices, and public enforcement decisions
Amounts were adjusted for inflation on 1 January 2025 and are reviewed every two years.
How Our CCPA Readiness Assessment Works
Six stages, from the first call to a roadmap your leadership can sign off. The independent cybersecurity audit is a separate engagement.
Not sure whether you need a cybersecurity audit, or when your first one is due? A free scoping review answers that first.
Book a free scoping reviewCCPA vs GDPR: What Carries Over and What Doesn't
A GDPR program covers much of the CCPA, but California works on a different model.
| Topic | GDPR | CCPA and CPRA |
|---|---|---|
| Basic model | A lawful basis is needed before processing | Notice and opt-out; opt-in only for some uses, such as minors' data |
| Who is covered | Any organization processing EU personal data | For-profit businesses that meet a revenue or volume test |
| Selling and sharing data | Covered by lawful basis and transparency rules | A specific right to opt out, including through browser signals |
| Breach notice | 72 hours to the regulator | 30 days to affected Californians; sample to the Attorney General if over 500 |
| Fines | Up to 4% of global turnover or €20 million | Per violation, up to $7,988 each, plus breach lawsuits |
| Security audits | No set audit cycle | Yearly independent cybersecurity audits for in-scope businesses |
Our GDPR compliance services and CCPA work share one data map, so you do not document the same systems twice. ISO/IEC 27701 gives independent evidence of privacy management across both laws, and AI teams preparing for the ADMT rules can align them with AI governance work.
CCPA Compliance Cost and Timeline
We do not publish a price list. The cost depends on your data, systems, and whether you need a readiness assessment, an independent cybersecurity audit, or both at different times. A free scoping review gives you a tailored proposal.
What shapes the scope
- Websites and apps — where notices, cookies, and opt-outs need testing
- Systems and vendors — where personal information is stored and sent
- Sensitive data and minors — extra rules and higher fines
- Automated decisions — whether ADMT rules apply
- Reuse — ISO 27001, SOC 2, or NIST evidence already in place
How long it takes
| Readiness assessment | 6–12 weeks, depending on scope |
|---|---|
| Cybersecurity audit | Planned around the audit year; scoped after the review |
| Ongoing review | Yearly, or when the regulations change |
How to Choose CCPA Compliance Services
Questions worth asking any CCPA compliance provider, and how Accredify Global answers them.
| Question to ask | Accredify Global's answer |
|---|---|
| Can you certify us for CCPA? | No one can. There is no CCPA certificate; we assess readiness and audit security. |
| Can you be our independent cybersecurity auditor? | Yes. Our auditors are independent of your security team, and findings rest on evidence. |
| Can you both build and audit our program? | No. To stay independent, we do not design or run the program we audit. |
| Do you test opt-outs and requests? | Yes, on your live site and with real requests. |
| Do you give legal advice? | No. Legal interpretation stays with your counsel. |
| How is it priced? | A tailored proposal after a free scoping review. |
What You Receive From a CCPA Engagement
Which thresholds and new duties apply, and when.
Personal and sensitive data across systems and vendors.
What happened when we used your links, signals, and forms.
Actions in priority order, with owners and dates.
For audit engagements: a signed, evidence-based report.
A plain summary for the executive who certifies to CalPrivacy.
Frequently Asked Questions About CCPA Compliance
Straight answers on scope, audits, opt-outs, fines, cost, and timeline.
What is the difference between the CCPA and the CPRA?
The California Consumer Privacy Act (CCPA) took effect on 1 January 2020. The California Privacy Rights Act (CPRA), approved by voters in November 2020, amended it from 1 January 2023, adding rights to correct data and limit sensitive data, and creating the California Privacy Protection Agency. Together they are usually just called the CCPA.
Does the CCPA apply to my business?
It applies to for-profit businesses doing business in California that meet any one test: annual gross revenue above $26,625,000; buying, selling, or sharing personal information of 100,000 or more California consumers or households; or earning half or more of revenue from selling or sharing personal information. Businesses outside California can be in scope.
Is there a CCPA certification?
No. There is no official CCPA certificate. Compliance is shown through notices, working opt-outs, request records, contracts, risk assessments, and, for in-scope businesses, yearly cybersecurity audits. ISO/IEC 27701 and ISO 27001 certificates give independent evidence that supports this.
Who enforces the CCPA?
The California Privacy Protection Agency, now known as CalPrivacy, and the California Attorney General. Both can bring enforcement actions. Consumers can also sue after certain data breaches caused by a failure to keep reasonable security.
What are the CCPA fines?
Since 1 January 2025, fines are up to $2,663 per violation and up to $7,988 per intentional violation or violation involving consumers under 16. In breach lawsuits, damages are $107 to $799 per consumer per incident, or actual damages if greater.
What is a CCPA cybersecurity audit?
A yearly, independent audit of a business's cybersecurity program under the CCPA regulations that took effect on 1 January 2026. The auditor checks applicable areas such as access controls, encryption, vulnerability management, logging, vendor oversight, and incident response, and a business executive then certifies completion to CalPrivacy.
When is the first CCPA cybersecurity audit due?
Certifications are due on 1 April 2028 for businesses with revenue over $100 million, 1 April 2029 for $50 to 100 million, and 1 April 2030 for the rest. After the first one, audits are yearly.
Who can perform a CCPA cybersecurity audit?
A qualified, objective, and independent auditor, either internal or external. The auditor must report to someone who is not responsible for the cybersecurity program, and findings must rest on evidence rather than management statements. Accredify Global can act as an external auditor, provided we have not designed or run the program.
Can we reuse our ISO 27001 or SOC 2 audit for the CCPA audit?
Partly. The regulations allow an assessment done for another purpose if it meets the CCPA requirements on its own or with additions. An ISO 27001 audit, SOC 2 report, or NIST CSF assessment often covers much of the ground, and a gap review shows what to add.
What are CCPA risk assessments?
Assessments a business must complete before high-risk processing, such as selling or sharing personal information, processing sensitive data, or using automated decisionmaking for significant decisions. Processing that began before 2026 needs an assessment by 31 December 2027, and a summary goes to CalPrivacy by 1 April 2028.
What are the CCPA rules on automated decisionmaking technology?
Businesses that use automated decisionmaking technology for significant decisions, such as lending, housing, education, employment, or healthcare, must give a pre-use notice, offer an opt-out with exceptions, and answer access requests about the logic and outcome. These duties apply from 1 January 2027.
Do we have to honor Global Privacy Control?
Yes. The CCPA regulations require businesses to treat an opt-out preference signal such as Global Privacy Control as a valid request to opt out of the sale or sharing of personal information for that browser or device.
How fast must a data breach be reported in California?
Since 1 January 2026, SB 446 requires notice to affected California residents within 30 days of discovering a breach. If more than 500 residents are affected, a sample notice goes to the Attorney General within 15 days of notifying them.
How long and how much does a CCPA compliance assessment take?
Most readiness assessments take 6 to 12 weeks, depending on how many websites, systems, and vendors are in scope. There is no list price. A free scoping review gives you a tailored proposal for the assessment, the cybersecurity audit, or both.
Do you give legal advice on the CCPA?
No. We assess and test your privacy and security controls and perform independent audits. Legal interpretation stays with your counsel, and we work alongside them.
Know Where You Stand on CCPA Before Your First Audit Is Due
Tell us about your California customers, systems, and vendors. We'll confirm which duties apply, when your first cybersecurity audit is due, and send a tailored proposal.
Book your free scoping review →Last reviewed by the Accredify Global compliance team.