Most of the attention on California's new privacy regulations has gone to automated decisions, because that is the part with a January 2027 date on it. Sitting alongside it is a second obligation with a different shape: a narrower set of businesses, a longer fuse, and a deadline set by revenue in a year that is different for each band. For the largest businesses that year is 2026, which is nearly over, and the first audit period opens on 1 January 2027.
If your business is covered, you will owe an independent cybersecurity audit. Whether you are covered, and which April you owe it by, are two separate questions.
This is a builder's read of the requirement, not legal advice. Your counsel decides whether you are in scope. This is what to have ready once they tell you.
Corrected 18 October 2026. The first version of this post said the audit follows the general CCPA business test, and that 2026 revenue sets all three deadlines. Both were wrong. Section 7120(b) of the adopted regulations is narrower on coverage, and section 7121(a) measures each deadline on revenue in a different year. The sections below follow the adopted text, and we say where something is our reading rather than the text.
Who is covered, and which April is yours
Coverage. Section 7120(b) gives two ways in, both measured on the preceding calendar year, and meeting either one is enough:
- 1.The business derives 50% or more of its annual revenue from selling or sharing personal information (the threshold in Civil Code 1798.140(d)(1)(C)). That is section 7120(b)(1), and it applies at any size.
- 2.The business meets the revenue threshold in Civil Code 1798.140(d)(1)(A), currently gross annual revenue above $26,625,000, and it processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers. That is section 7120(b)(2). The revenue figure is generally read on global gross revenue rather than California revenue.
The general CCPA business test has a third threshold, buying, selling or sharing the personal information of 100,000 or more consumers or households. Section 7120(b) does not point at it. Our reading, not the text: a business that is covered by the CCPA only through that 100,000-consumer threshold is not caught by the audit requirement. Ask counsel before you rely on it.
Phasing. Section 7121(a) sets three first-report dates, and each one is measured on revenue in a different year:
| Report due | Revenue year | Band | Audit period |
|---|---|---|---|
| 1 April 2028 | 2026 (as of 1 Jan 2027) | Over $100 million | 1 Jan 2027 to 1 Jan 2028 |
| 1 April 2029 | 2027 (as of 1 Jan 2028) | Middle band | 1 Jan 2028 to 1 Jan 2029 |
| 1 April 2030 | 2028 | Lowest band | 1 Jan 2029 to 1 Jan 2030 |
The dollar edges of the middle and lowest bands are in section 7121(a)(2) and (3). After 1 April 2030 section 7121(b) sets a repeating cycle: if you meet the section 7120 criteria on 1 January of a year, you audit the following 12 months and report by 1 April of the year after that.
Three things follow. Only the top band is decided by 2026 revenue, so for everyone else the year that sets your date has not happened yet. Our reading, not the text: because each band is read off one named year, a company that clears $100 million in 2026 is in the earliest cohort even if revenue later falls. And for the top band the distance is shorter than 2028 sounds. Findings must rest primarily on evidence rather than on management's assertions (section 7122(d)), so the controls need to be running and leaving records when the period opens on 1 January 2027, not set up during it.
What "independent" actually constrains
The audit has to be performed by a qualified, objective, independent professional (section 7122(a)), and that is the requirement most likely to change how your engineering organisation is structured, not just what it documents.
In practice it rules out the comfortable arrangement where the team that runs security also assesses it. An internal auditor can qualify, but the highest-ranking internal auditor has to report directly to an executive who has no direct responsibility for the cybersecurity programme, and that executive evaluates the auditor and sets their pay (section 7122(a)(3)). The auditor also must not take part in implementing or maintaining the programme being audited, or in recommending changes to it apart from stating findings (section 7122(a)(2)). If the person who would audit engineering controls reports up through the executive who runs security, that is a conflict you need to resolve before an auditor asks about it rather than during.
What the audit is actually looking at
The programme under review is the one protecting personal information from unauthorised access, destruction, use, modification or disclosure. Expect the familiar control families, examined for evidence rather than intent:
- Authentication and access control, including how privileged access is granted and removed
- Encryption at rest and in transit
- Account management and the joiner-mover-leaver process
- Vulnerability management and patching cadence
- Logging, monitoring and how alerts actually get actioned
- Incident response, including whether the plan has been exercised
- Vendor and service-provider oversight, which is where most engineering teams are thinnest
- Training, and evidence people completed it
The through-line is that assertions are worth nothing. A documented policy that nobody follows is a finding, not a control, and it is a worse finding than an absent policy because it is now written down.
Two obligations that turn into engineering work
Retention. The business and the auditor must each keep every document relevant to an audit for at least five years after the audit is completed (section 7122(g)). That is longer than most logging retention defaults, and it is a decision to make deliberately rather than inherit from a platform. If your evidence lives in a system that rolls off at 30 or 90 days, the evidence for your audit period is being deleted as fast as it is produced.
Certification. In each year an audit is required, an executive who is directly responsible for audit compliance files a certification of completion with the California Privacy Protection Agency by 1 April, signed under penalty of perjury (section 7124). So unlike an internal security review that can quietly slip, this one has a filing attached and a date attached to the filing.
What to do while it is still cheap
Nothing here needs a consultant yet. Four things a team can do in a fortnight:
- 1.Establish whether you are covered, then which April applies. Coverage turns on revenue mix, revenue and the number of consumers or households whose data you process. The band turns on revenue in one named year. Both are finance and data questions, not security ones, and they set your whole timeline. If you could be in the top band, ask now, while 2026 revenue is still being earned rather than reconstructed.
- 2.Fix retention before you fix controls. Everything else can be improved later; evidence you did not keep cannot be recovered. This is the single item with a hard dependency on time, the same reason decision logging belongs at the top of an ADMT backlog rather than the bottom.
- 3.Check the independence question. Look at your reporting lines and decide whether an internal audit could credibly be called objective. If not, that is a hiring or structural decision with a lead time.
- 4.Inventory your subprocessors. Vendor oversight is where audits most often find gaps, and the list itself usually takes longer to assemble than anyone expects. If you use development partners, how you vet them is part of this answer.
What this means for your team
- Coverage is narrower than the general CCPA test. Section 7120(b) asks for the 50% revenue test, or the revenue threshold plus 250,000 consumers or households (or 50,000 consumers' sensitive data).
- The deciding year depends on your band. For the top band it is 2026, which is nearly over, and the first audit period opens on 1 January 2027. For the other two it is 2027 or 2028.
- Evidence beats policy. Auditors test whether a control operated, not whether it was described.
- Retention is the irreversible item. Five years after the audit is the bar, and defaults are usually far shorter.
- This obligation is separate from the ADMT rules but lands on the same teams. If you are already scoping what the ADMT rules require you to build, fold the audit inventory into the same exercise rather than running two.
If you are working out whether you are covered, which April applies and what evidence you would be able to produce today, that is a short and useful conversation. Tell us what your stack looks like and we will tell you where the gaps usually are at your size.
Sources
- California Privacy Protection Agency: adopted CCPA regulations, Title 11 Division 6 Chapter 1, effective 1 January 2026, sections 7120 to 7124
- California Privacy Protection Agency: the CCPA statute, Civil Code 1798.140(d)(1)
- California Privacy Protection Agency: CCPA updates, cybersecurity audits, risk assessments and ADMT
- California Privacy Protection Agency: updated monetary thresholds
- Ropes & Gray: California's CCPA cybersecurity audit rule takes effect
- Skadden: California finalizes CCPA regulations for ADMT, risk assessments and cybersecurity audits
