CCPA risk assessments: how do you document significant-risk processing?

If your firm screens applicants with an AI tool, shares website data with advertising platforms, or uses sensitive employee data beyond payroll and benefits, California now expects a written CCPA risk assessment for that processing. The deadline for processing already under way is December 31, 2027, and an executive signs the summary under penalty of perjury the following April.

Which processing activities require a CCPA risk assessment?

Section 7150 of the CCPA regulations lists six categories of processing that present significant risk to consumers' privacy, and each one requires a CCPA risk assessment. Article 10 of the CCPA regulations, sections 7150 through 7157, sets out the full framework. A business that does any of the following has to complete a risk assessment for that processing:

• Selling or sharing personal information, which includes cross-context behavioral advertising through cookies and tracking pixels.
• Processing sensitive personal information, with narrow exceptions for routine employment administration such as payroll, benefits and reasonable accommodations.
• Using automated decisionmaking technology (ADMT) to make a significant decision about a consumer, such as a decision about employment, lending, housing, education or healthcare.
• Using automated processing to infer a person's characteristics from systematic observation of them as a job applicant, employee, independent contractor or student.
• Using automated processing to infer characteristics based on a person's presence at a sensitive location.
• Processing personal information the business intends to use to train ADMT for a significant decision, or to train facial recognition, emotion recognition or identity verification technology.

The list is specific on purpose. Ordinary processing that fits none of these categories does not trigger the requirement, which is why the first job is a written determination of which activities fall inside it and which do not.

Does the CCPA risk assessment rule apply to a financial firm that follows GLBA?

Yes, for much of a financial firm's non-client data, because the GLBA exemption covers information rather than firms. The CCPA's exemption for GLBA-covered information in Civil Code section 1798.145(e) applies to personal information collected under GLBA. Client account data sits outside the CCPA, but employee records, job applicant files, website visitor data and marketing lists generally do not. An RIA, broker-dealer or insurance agency that meets a CCPA threshold, such as annual gross revenue above the inflation-adjusted figure of $26,625,000, can still run triggering processing on that non-GLBA data. We cover the boundary in more detail in Does the CCPA GLBA exemption cover your whole firm?

For most professional firms, the activities that deserve a close look are an AI resume screening tool, employee monitoring software that scores productivity, website tracking pixels shared with advertising platforms, and any sensitive personal information about staff that is used beyond payroll and benefits.

When are the risk assessments due?

CCPA risk assessments are due before new processing begins, or by December 31, 2027 for processing already under way before 2026. The California Privacy Protection Agency set these dates when it finalized the regulations, and section 7155 holds the detail:

• Processing that begins on or after January 1, 2026 needs a completed risk assessment before the processing starts.
• Processing that was already under way before January 1, 2026 and continues needs a completed assessment by December 31, 2027.
• Each assessment must be reviewed and updated at least once every three years, and within 45 days of a material change to the processing.
• Each assessment must be kept for as long as the processing continues, or five years after the assessment is completed, whichever is later.

The ADMT rules themselves take effect January 1, 2027, so a firm adopting an AI hiring or screening tool in 2027 has two obligations landing together: the pre-use notice and opt-out under the ADMT rules, and a risk assessment completed before the tool goes live. Our article on the CCPA ADMT rules covers the first half.

What does a CCPA risk assessment have to contain?

A CCPA risk assessment must be a written analysis showing that the business weighed the privacy risks of the processing against its benefits, with enough operational detail that someone outside the project can follow it. Section 7152 sets out the contents, which include:

• The specific purpose of the processing, described concretely rather than in generic terms such as "to improve our services."
• The categories of personal information involved, including any sensitive personal information, and why each is needed.
• Operational elements: how the information is collected, how long each category is kept, how consumers interact with the business, the approximate number of consumers affected, what disclosures they receive, and which service providers, contractors or third parties receive the information.
• For ADMT, the logic of the technology and how its outputs are used.
• The benefits to the business, the consumer and others, and the negative impacts to consumers' privacy.
• The safeguards the business will use to address those negative impacts.
• Whether the business will go ahead with the processing, who contributed to the assessment, and the dates and names of the people who reviewed and approved it.

Section 7151 adds a staffing rule: employees whose job duties include participating in the processing must be involved in the assessment. The people who run the hiring tool or manage the tracking pixels have to contribute, so the document cannot be written from a policy binder alone.

What happens if the risks outweigh the benefits?

If the privacy risks outweigh the benefits, the processing should not go ahead as designed. Section 7154 states the goal of a risk assessment as restricting or prohibiting processing where the risks to consumers' privacy outweigh the benefits. In practice that means the document needs a real conclusion. An assessment that lists risks, lists safeguards and never reaches a decision is the kind of record that invites questions.

What gets filed with the Agency, and who signs it?

Businesses file a summary of their risk assessments and an executive attestation with the California Privacy Protection Agency, and keep the full reports on hand. Under section 7157, the first submission is due April 1, 2028 and covers assessments conducted in 2026 and 2027. After that, submissions are due each April 1 for the prior calendar year. The submission includes the business's contact information, the period covered, the number of assessments conducted or updated, and whether they involved certain categories of personal information.

The attestation is signed under penalty of perjury by a member of the business's executive management who is directly responsible for risk assessment compliance and has sufficient knowledge of the assessments. In a professional firm, that could be the COO, general counsel or managing partner. The Agency or the Attorney General can also request the full risk assessment reports, which must then be produced within 30 calendar days.

Section 7156 offers two efficiencies. One assessment can cover a comparable set of processing activities, and an assessment prepared for another law can be used if it contains the required information or is supplemented to do so.

What should a firm do this quarter?

Start with an inventory, because the December 31, 2027 deadline for existing processing arrives faster than it looks once vendors and department heads are involved.

• List every system that touches personal information outside GLBA-covered client data: HR and payroll, applicant tracking, website analytics and advertising tags, CRM and marketing tools, and every AI tool staff use.
• Mark each activity against the six section 7150 categories and record the reasoning, including for activities you conclude are out of scope.
• For anything in scope that started before 2026, schedule the assessment now and name the employees who run that processing as contributors.
• For anything new planned for 2027, especially AI tools used in hiring or performance review, build the assessment into the procurement approval so the tool cannot go live without it.
• Pick the executive who will sign the 2028 attestation and agree on what evidence they will want to see before signing.

How does s90 help?

The hardest part of a risk assessment is usually the operational detail: which systems collect what, where it flows, how long it stays and who can reach it. s90 maintains that inventory as part of managed IT, including the AI tools and browser extensions staff adopt on their own, and our CCPA compliance package turns it into evidence a signing executive can rely on. If you want a second set of eyes on your processing inventory before the assessments start, we are happy to talk.