California Risk Assessments: Seven Steps for Employers

Effective January 1, 2026, the California Consumer Privacy Act (CCPA) requires certain employers to complete detailed, documented risk assessments before engaging in many routine data processing practices. Because the assessments must be finalized before Covered Processing begins—and because they must include the date of approval and the names of reviewers—employers cannot wait to “backfill” assessments later.... By: Littler