California’s New Privacy Risk Assessment Rules Turn PIAs Into an Operational Imperative

California’s CCPA risk assessment rules change how privacy teams need to manage PIAs.

As of January 1, 2026, covered businesses must conduct and document risk assessments before engaging in certain processing activities that pose a significant risk to consumers’ privacy. Existing covered processing must also be assessed by December 31, 2027; material changes can require updates within 45 calendar days, and businesses must prepare to submit summary information and executive attestations to the California Privacy Protection Agency beginning April 1, 2028.

For privacy leaders, this is not just a new form to complete. It is required to identify covered processing early, route it to the appropriate stakeholders, document risks and safeguards, track changes, and maintain evidence that decisions were made consistently and defensibly.

That makes the PIA a living operational record, not a point-in-time compliance artifact.

What California’s CCPA Risk Assessment Rules Require

The California Privacy Protection Agency finalized regulations covering risk assessments, cybersecurity audits, automated decision-making technology, and other CCPA requirements in 2025. The regulations took effect on January 1, 2026, with specific compliance timelines for risk assessments and related reporting.

Under the risk assessment rules, a covered business must conduct and document a risk assessment before initiating processing that presents a significant risk to consumers’ privacy.

Covered activities may include:

• Selling or sharing personal information
• Processing sensitive personal information, subject to limited exceptions
• Using automated decision-making technology to make significant decisions about consumers
• Using certain automated processing to profile people in employment, education, or sensitive-location contexts
• Processing personal information to train certain automated decision-making, facial-recognition, emotion-recognition, or biometric technologies

The full categories and exceptions are defined in Section 7150 of the final regulations.

The key point for privacy teams is scope. California is not requiring a formal assessment for every routine data activity. But it is bringing many privacy, advertising, sensitive data, profiling, and AI-related activities into a structured assessment process that must occur before covered processing begins.

New Processing Must Be Assessed Before It Begins

For covered processing initiated on or after January 1, 2026, the risk assessment must be completed and documented before the activity begins.

That changes where privacy review must sit within the business.

A PIA can no longer be treated as a retrospective record created after a product launch, vendor implementation, marketing campaign, or AI deployment. Privacy review needs to connect to the systems where new processing originates, including:

• Product development
• Procurement and vendor onboarding
• Data governance
• Marketing operations
• AI governance
• Human resources
• Security and technology change management

If privacy teams learn about covered processing only after deployment, the organization may already be behind.

Existing High-Risk Processing Also Needs Attention

Businesses must assess covered processing that began before the regulations took effect and continues afterward. Those assessments must be completed by December 31, 2027.

That creates two simultaneous workstreams for privacy teams:

• Assess the new covered processing before it begins
• Build and work through an inventory of existing covered processing before the transition deadline

Organizations without a reliable view of where personal information is collected, used, shared, sold, or incorporated into automated systems may find the inventory itself to be the first operational challenge.

The work cannot remain solely with the privacy office. The regulations contemplate participation by employees involved in the processing, making cross-functional intake and collaboration essential.

Material Changes Can Start a 45-Day Update Clock

Completing an assessment does not end the obligation.

Businesses must review their risk assessments at least once every three years and update them when necessary. More urgently, a material change to a covered processing activity requires the assessment to be updated as soon as feasibly possible and no later than 45 calendar days after the change.

A change may be material when it:

• Creates new negative impacts for consumers
• Increases the likelihood or magnitude of previously identified impacts
• Reduces the effectiveness of existing safeguards

The regulations identify changes in processing purpose, data minimization, and newly raised consumer concerns as possible examples.

This turns the PIA from a static document into a living operational record.

A team may add a new data source, expand a use case, introduce a vendor, deploy an AI feature, change a retention period, or begin using an existing dataset for a different purpose. Any of those developments may require the organization to determine whether the change is material and, if it is, update the assessment within the prescribed period.

That is difficult to manage through spreadsheets, email threads, shared drives, and institutional memory.

CPPA Reporting Begins in 2028, but Accountability Starts Now

For assessments conducted or updated in 2026 and 2027, covered businesses must submit required information to the California Privacy Protection Agency by April 1, 2028. Subsequent submissions are due by April 1 of the year following which assessments were conducted or updated.

The routine submission is not a copy of every full risk assessment. It includes summary information such as:

• The number of assessments conducted or updated
• The types of covered processing involved
• The categories of personal and sensitive personal information involved
• An attestation that the required assessments were completed

That attestation must be submitted under penalty of perjury by a member of executive management who is responsible for risk-assessment compliance, has sufficient knowledge of the program, and has authority to submit it.

The Agency or the California Attorney General may also request the underlying risk assessment reports at any time. If requested, a business must provide them within 30 calendar days.

The implication is clear: organizations need more than a collection of completed forms. They need evidence that their assessment program is complete, current, consistently applied, and ready for executive certification or regulatory review.

Why Manual PIA Programs May Struggle with CCPA Risk Assessment Compliance

The biggest compliance challenge may not be understanding the risk assessment requirement. It may involve ensuring that every covered activity enters the process early enough, follows the right review path, and leaves behind a complete record.

Manual PIA programs often depend on business teams knowing when to involve privacy, reviewers tracking decisions across email, and privacy teams maintaining deadlines in spreadsheets or shared files. That model becomes harder to defend when assessments must be completed before processing begins, updated after material changes, and summarized for executive attestation.

A defensible process should be able to answer practical questions quickly:

• Which processing activities require assessment?
• Who owns each assessment?
• Was the assessment completed before processing began?
• What risks, benefits, safeguards, and alternatives were evaluated?
• Who reviewed and approved the decision?
• Has the processing changed since approval?
• Was the assessment updated within 45 days when required?
• Can the organization produce the assessment history and supporting rationale?

If those answers require searching across inboxes, spreadsheets, and disconnected files, the organization has an operational visibility problem, not simply a documentation problem.

How to Build a Repeatable Privacy Assessment Operating Model

California’s rules reinforce a broader shift in privacy management: compliance needs to be embedded in how organizations introduce and change data processing.

A repeatable assessment lifecycle should include:

• Capture: Give product, procurement, marketing, HR, data, AI, and business teams a consistent way to submit proposed processing activities and changes.
• Assess: Apply defined criteria to determine whether a risk assessment is required, then evaluate risks, benefits, safeguards, and alternatives.
• Coordinate: Route the assessment to privacy, legal, security, product, data, and business stakeholders based on the nature of the processing.
• Decide: Document approvals, conditions, remediation steps, and the rationale for proceeding or not proceeding.
• Monitor: Track material changes, review dates, mitigation commitments, and regulatory deadlines.
• Demonstrate: Maintain a centralized record that supports executive reporting, audits, and regulatory inquiries.

This is where privacy workflow technology can help translate regulatory requirements into a consistent operating process.

How RadarFirst Helps Operationalize PIAs, DPIAs, and CCPA Risk Assessments

RadarFirst helps organizations manage PIAs, DPIAs, and CCPA risk assessments through configurable workflows designed for consistent, defensible decision-making.

With RadarFirst Custom Compliance Workflows, privacy teams can:

• Standardize assessment intake across teams and systems
• Configure workflows around internal policies and regulatory requirements
• Apply consistent risk criteria and assessment frameworks
• Assign owners, reviewers, approvers, and required actions
• Coordinate privacy, legal, compliance, security, data, and business stakeholders
• Track assessment status, review dates, material changes, and remediation
• Preserve the rationale and supporting context behind decisions
• Maintain centralized documentation for reporting, audits, and regulatory inquiries

Technology does not replace privacy or legal judgment. It gives that judgment a structured operating model, so teams can move faster while preserving the evidence needed to demonstrate diligence.

Why Privacy Teams Should Act Now

April 1, 2028, may sound distant. Operationally, it is not.

The records that support the first CPPA submission are being created now. New covered processing already requires assessment before it begins, and organizations must also identify and assess existing covered processing before the December 31, 2027 deadline.

Privacy teams should use 2026 to:

• Identify processing activities covered by California’s risk assessment requirements
• Connect PIA intake to product, procurement, AI, marketing, HR, and data-governance workflows
• Define how the organization will identify and escalate material changes
• Establish ownership for assessments, approvals, updates, and reporting
• Replace fragmented records with a centralized, traceable process
• Build reporting that gives executives confidence in attestations submitted to the CPPA

California has moved privacy risk assessments beyond a periodic compliance exercise. The organization best prepared for scrutiny will not simply have more assessments. They will have a repeatable way to identify risk, guide decisions, manage change, and demonstrate what happened.

See how RadarFirst helps privacy teams centralize PIA intake, orchestrate reviews, track material changes, and maintain audit-ready records for CCPA risk assessment compliance.

This article is for informational purposes and does not constitute legal advice.