CCPA / CPRA: Cybersecurity audit due: revenue over $100M
Tech · Compliance deadlines · Sat, April 1, 2028 · California · US
First cybersecurity audit report (covering Jan 1, 2027 - Jan 1, 2028) and certification due for businesses with 2026 annual gross revenue over $100M (11 CCR 7121(a)(1)). Not legal advice.
Every year
| Date | Event | When |
|---|---|---|
| Wed, Jan 1, 2020 | CCPA / CPRA: CCPA takes effect | 7 yr ago |
| Sun, Jan 1, 2023 | CCPA / CPRA: CPRA amendments operative | 4 yr ago |
| Wed, Jan 1, 2025 | CCPA / CPRA: CPI adjustment of thresholds and fines | 2 yr ago |
| Mon, Sep 22, 2025 | CCPA / CPRA: ADMT, risk assessment and cybersecurity audit regulations approved | 12 mo ago |
| Thu, Jan 1, 2026 | CCPA / CPRA: New CCPA regulations take effect | 9 mo ago |
| Fri, Jan 1, 2027 | CCPA / CPRA: ADMT requirements compliance date | in 3 mo |
| Fri, Jan 1, 2027 | CCPA / CPRA: Browsers must support opt-out preference signal (AB 566) | in 3 mo |
| Fri, Dec 31, 2027 | CCPA / CPRA: Risk assessments for pre-existing processing due | in 15 mo |
| Sat, Apr 1, 2028 | CCPA / CPRA: First risk assessment submission to CPPA | in 2 yr |
| Sat, Apr 1, 2028 | CCPA / CPRA: Cybersecurity audit due: revenue over $100M | in 2 yr |
| Sun, Apr 1, 2029 | CCPA / CPRA: Cybersecurity audit due: revenue $50M-$100M | in 3 yr |
| Mon, Apr 1, 2030 | CCPA / CPRA: Cybersecurity audit due: revenue under $50M | in 4 yr |
Source, method and history
- Source
- Regulations
- How we know
- From the Regulations API (regulations.fru.dev), which cites the official text.
- Recurs
- one-off
- More on fru.dev
- regulations.fru.dev
- Feed
- Subscribe to Compliance deadlines
- Changes
- 2026-09-25: added to 2028-04-01