CPPA Adopts CCPA Regs: Cybersecurity, Risk, and ADT

On July 24, 2025, the California Privacy Protection Agency (CPPA) voted to adopt draft regulations under the California Consumer Privacy Act (CCPA) concerning cybersecurity audits, risk assessments, and automated decision-making technologies (ADMT). These regulations are expected to significantly impact how organizations, including credit unions, handle consumer data and privacy.

The California Credit Union League has actively participated in this rulemaking process, submitting comment letters (read here and here) that expressed concerns about the potential burdens these regulations could place on credit unions, particularly given existing compliance obligations.

The adopted regulatory package will now undergo a thirty-working-day review by the Office of Administrative Law (OAL) to ensure compliance with California’s Administrative Procedures Act and OAL’s regulations. If approved, the regulations are currently slated to take effect on October 1, 2025.

Key aspects of the new draft regulations include:

• Cybersecurity Audits: Requires certain businesses whose processing of personal information presents a “significant risk” to consumer security to conduct independent cybersecurity audits annually. These audits must assess the effectiveness of the cybersecurity program, identify gaps, and require an annual written certification to the CPPA. Compliance deadlines are staggered based on revenue (e.g., April 1, 2028, for businesses over $100 million in gross revenue; April 1, 2030, for smaller businesses).
• Risk Assessments: Mandates documented risk assessments for data processing activities that pose a “significant risk” to consumers’ privacy, such as selling/sharing personal information, processing sensitive data, or using ADMT for significant decisions. These assessments must identify benefits, risks, and safeguards, and be reviewed at least every three years or upon material change.
• Automated Decision-Making Technologies (ADMT): Defines ADMT broadly to include technologies using computation to replace or substantially facilitate human decision-making (e.g., AI/machine learning). Introduces new consumer rights, including a “pre-use notice” for ADMT, a right to opt-out of most ADMT uses, and a right to appeal “significant decisions” made by ADMT (e.g., related to financial services, housing, or employment), which must include human review. Compliance for ADMT requirements is set for January 1, 2027.

The League is currently preparing a comprehensive executive summary of these new regulations, which will provide more detailed insights and guidance, and will make it available to credit unions soon.

For More Information

Access the ‘Compliance Hotline’

Your League-member benefits include the Compliance Hotline — providing exclusive access to dedicated compliance experts:

• 844-731-6072
• CANV@viclarityus.com

Using the above phone number and email address, you can gain access to a knowledgeable team that’s ready to address all your credit union’s compliance inquiries — promptly and efficiently. With the Compliance Hotline, you can proactively respond to impromptu questions and issues by getting clarity and insight on technical topics that normally slow you down. We want to help you unlock the full potential of your League membership by leveraging the resources and support you need to navigate the complex world of compliance effortlessly. We’re ALWAYS just a phone call or email away!

Additionally, other League-member compliance resources include:

• ViClarity
• CU PolicyPro
• ComplySight
• InfoSight
• CU Store
• Record Retention Guide
• GRC Technology Solutions

For more information, email Lisa Quaranta.

Powered by ViClarity, a California and Nevada Credit Union Leagues company.