California Consumer Privacy Act (CCPA/CPRA)
California consumer privacy rights, business duties, and the 2025 ADMT, risk-assessment and cybersecurity-audit regulations, subject to the GLBA/CalFIPA partial exemption.
- Issued by
- California Privacy Protection Agency / Attorney General
- Applies in
- United States
- Edition
- Regulations from 1 January 2026; ADMT duties from 1 January 2027
- Area
- Data protection & privacy
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- 1798.100Notice at collection, purpose limitation, retention disclosure and reasonable securityTransparency
- 1798.105/106/110Honour verifiable requests to delete, correct and knowConsumer rights
- 1798.120/121Honour opt-out of sale/sharing and limit use of sensitive personal informationConsumer rights
- 1798.145(e)Scope data correctly under the GLBA/CalFIPA exemptionScope
- 1798.150Maintain reasonable security to avoid breach liability (applies to GLBA data too)Security
- 7050-7051Contract with service providers and contractors on required termsThird parties
- 7150-7157Conduct and document risk assessments before high-risk processingRisk assessment
- 7120-7124Complete annual independent cybersecurity auditsSecurity
- 7200-7222Pre-use notice, opt-out (or human appeal exception) and access for ADMT used in significant decisionsAutomated decisions
How Amoreg keeps you on it.
Enable the California Consumer Privacy Act (CCPA/CPRA) and add California Privacy Protection Agency / Attorney General’s pages as a monitor of your own. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 9 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read California Privacy Protection Agency / Attorney General’s pages
- Check the library against 9 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: notice at collection, purpose limitation, retention disclosure and reasonable security
- Rule
- California Consumer Privacy Act (CCPA/CPRA), 1798.100
- Area
- Transparency
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- EU General Data Protection RegulationThe data protection regime for controllers and processors established in, or targeting, the EU.European Union · 9 controls
- UK GDPR & Data Protection Act 2018The UK data protection regime after Brexit, with the ICO as supervisory authority.United Kingdom · 9 controls
- Data Protection (Bailiwick of Guernsey) Law, 2017The Bailiwick's GDPR-equivalent law, with EU adequacy.Guernsey · 9 controls
- Data Protection (Jersey) Law 2018Jersey's GDPR-equivalent law and the Data Protection Authority (Jersey) Law 2018 registration regime.Jersey · 9 controls
- Isle of Man GDPR & LED Implementing Regulations 2018The applied GDPR under the Data Protection Act 2018 (Isle of Man).Isle of Man · 9 controls
- Cayman Islands Data Protection ActEight data protection principles modelled on the UK Data Protection Act 1998, in force since 2019.Cayman Islands · 6 controls
Also in United States
- US Bank Secrecy Act / FinCEN AML ProgramBSA AML programme requirements: the pillars, CDD rule, SAR/CTR reporting and beneficial ownership.United States · 6 controls
- OFAC Sanctions Compliance ProgramThe five essential components of an effective sanctions compliance programme.United States · 5 controls
- US Foreign Corrupt Practices ActAnti-bribery and books-and-records provisions, assessed against the DOJ's Evaluation of Corporate Compliance Programs.United States · 4 controls
- GLBA Safeguards RuleThe information security programme financial institutions must maintain for customer information.United States · 5 controls
- NIST Cybersecurity Framework 2.0Six functions for managing cybersecurity risk, now including Govern.United States / Global · 6 controls
- NYDFS Cybersecurity Regulation (23 NYCRR 500)Cybersecurity requirements for DFS-licensed entities, with CISO, MFA, annual certification and 72-hour notice.United States — New York · 6 controls
Questions
Does Amoreg watch for changes to the California Consumer Privacy Act (CCPA/CPRA)?
Enable it and add the issuer’s pages as a monitor of your own. Every publication the Monitor records keeps its source, stage and date.
Can Amoreg check our policies against the California Consumer Privacy Act (CCPA/CPRA)?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records Regulations from 1 January 2026; ADMT duties from 1 January 2027. Editions were last verified in August 2026, and the Monitor records new publications as they appear.