The California Consumer Privacy Act’s security requirements boil down to one core duty with teeth around it: if your business is covered, you must protect certain categories of consumer personal information with reasonable security measures appropriate to its sensitivity, and starting in 2026 you may also need to run formal cybersecurity audits and risk assessments. Fall short and consumers can sue for $100 to $750 per person per breach, while the California Privacy Protection Agency can assess administrative fines up to $7,988 for each intentional violation.
Who Has to Comply
The CCPA’s security obligations apply to for-profit businesses doing business in California that meet at least one of three thresholds. The first is revenue: annual gross revenues above the inflation-adjusted figure, which sits at $26,625,000 following the 2025 biennial adjustment.1California Privacy Protection Agency. Updated Monetary Thresholds in CCPA
The second covers any business that annually buys, sells, or shares the personal information of 100,000 or more consumers or households.2California Legislative Information. California Code CIV 1798.140 – Definitions The third captures any business earning 50 percent or more of its annual revenue from selling or sharing consumer personal information.
A business that falls below all three is generally outside the CCPA’s specific security mandates. One extension matters: an entity that controls or is controlled by a covered business and shares common branding with it is also in scope, whether or not it independently crosses a threshold.
What Data the Security Duty Covers
The private lawsuit right for security failures hinges on a narrower definition of personal information in Cal. Civ. Code Section 1798.81.5, not the broad definition used elsewhere in the statute. It covers an individual’s name (first name or first initial plus last name) combined with any of the following when either the name or the data element is unencrypted and unredacted:
- Government identification numbers: Social Security number, driver’s license number, California ID card number, tax ID number, passport number, or military ID number.3California Legislative Information. California Civil Code 1798.81.5
- Financial account, credit card, or debit card numbers combined with any security code, access code, or password that would allow access to the account.
- Medical and health insurance information.
- Biometric data such as fingerprints and retina or iris images used to authenticate a specific person. An ordinary photograph does not count unless it is stored for facial recognition.
- Genetic data.
A separate trigger covers login credentials: a username or email address combined with a password or security question and answer that would allow access to an online account qualifies on its own, with no name required.4California Legislative Information. California Code CIV 1798.150 – Personal Information Security Breaches
Sensitive Personal Information
The California Privacy Rights Act added a broader category called sensitive personal information, which carries heightened use restrictions and security expectations. On top of the data elements above, it includes precise geolocation, racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership, the contents of private messages, neural data, and information about a consumer’s health, sex life, or sexual orientation.5California Privacy Protection Agency. What Is Personal Information? Consumers can tell businesses to limit how this information is used and disclosed, and processing it also triggers mandatory risk assessments under the 2026 regulations.
The Reasonable Security Standard
Cal. Civ. Code Section 1798.100(e) requires every covered business to implement reasonable security procedures appropriate to the nature of the personal information it holds.6California Legislative Information. California Civil Code 1798.100 Section 1798.81.5 adds a standalone duty: any business that owns, licenses, or maintains personal information about California residents must protect it from unauthorized access, destruction, use, modification, or disclosure.3California Legislative Information. California Civil Code 1798.81.5
The law deliberately avoids naming specific technologies. What counts as reasonable depends on how much data you hold, how sensitive it is, and the size and complexity of your operation. In practice, courts and regulators look at whether you followed an established cybersecurity framework.
The most frequently referenced benchmark is the CIS Critical Security Controls, published by the Center for Internet Security. California’s Attorney General identified these controls as the minimum level of security any organization holding personal information should meet in the state’s 2016 Data Breach Report, which stated that failing to implement all applicable controls “constitutes a lack of reasonable security.” The CIS Controls cover tracking hardware and software assets, managing vulnerabilities, restricting administrative privileges, defending against phishing, maintaining data recovery, and monitoring access. Many businesses map these alongside the National Institute of Standards and Technology Cybersecurity Framework to cover both California expectations and federal industry norms.
Reasonable security is not static. A posture that was defensible two years ago may be negligent today. Reassess regularly, train employees on current threats, and apply patches promptly. Documentation does enormous work in litigation: if you can show you evaluated your risks, chose controls appropriate to those risks, and kept them current, you have a defensible position. If you cannot, the absence of documentation itself becomes evidence of negligence.
Cybersecurity Audits and Risk Assessments Starting in 2026
Regulations that took effect on January 1, 2026, add two concrete obligations on top of the general duty.
Annual Cybersecurity Audits
Annual audits are required for any business whose data processing presents a “significant risk” to consumer security. The regulation defines significant risk two ways: the business earns 50 percent or more of its revenue from selling or sharing personal information, or it meets the adjusted revenue threshold (currently about $26.6 million) and processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers, in the calendar year.
The audit must be performed by an independent professional auditor. A written certification of completion goes to the California Privacy Protection Agency by April 1 each year, signed by a member of executive management directly responsible for cybersecurity audit compliance.7California Privacy Protection Agency. CCPA – Effective January 1, 2026 First deadlines are staggered: April 1, 2028, for businesses with over $100 million in revenue; April 1, 2029, for $50 million to $100 million; and April 1, 2030, for smaller covered businesses.
Risk Assessments
Risk assessments turn on the type of processing, not on business size. You must complete one before beginning any of the following: selling or sharing personal information, processing sensitive personal information, using automated decision-making technology for significant decisions about consumers, and using automated processing to infer characteristics like health, behavior, or economic status from systematic observation.8New York Codes, Rules and Regulations. Section 7150 – When a Business Must Conduct a Risk Assessment
The assessment must weigh the concrete benefits of the processing against the specific risks to consumer privacy. Generic justifications like “improving services” are explicitly rejected. The business must identify the categories of information involved, the minimum data necessary for the stated purpose, the safeguards in place, and a final decision about whether to proceed. An employee with authority over whether the processing happens must review and approve the assessment.
Vendor Contracts
Security obligations do not stop at your own walls. Section 1798.81.5 requires businesses that share personal information with third parties to contractually obligate those third parties to maintain reasonable security.3California Legislative Information. California Civil Code 1798.81.5 A boilerplate confidentiality clause will not do the job.
Both service providers and contractors must be contractually prohibited from selling or sharing the personal information they receive, using it beyond what the contract specifies, and combining it with information from other sources. Contractors face extra requirements: a written certification that they understand these restrictions, and permission for the business to monitor compliance. A business is not automatically liable for a vendor’s violations, but liability can attach when the business has actual knowledge of the problem, and a contractual right to monitor may create an obligation to use it when warning signs appear.
Breach Notification
When security fails and a breach occurs, Cal. Civ. Code Section 1798.82 kicks in. Any business that owns or licenses computerized data containing personal information must notify affected California residents within 30 calendar days of discovering or being notified of the breach.9California Legislative Information. California Code CIV 1798.82 The deadline can be extended only if law enforcement determines notification would interfere with a criminal investigation, or if the business needs more time to determine the scope of the breach and restore system integrity.
The notice must be titled “Notice of Data Breach” and organized under prescribed headings covering what happened, what information was involved, what the business is doing, what the consumer can do, and where to get more information. If the breach affects more than 500 California residents, the business must electronically submit a sample notification to the Attorney General within 15 calendar days of notifying consumers.
A business that only maintains data it does not own, such as a cloud hosting provider, has a different duty: notify the data owner or licensee immediately after discovering the breach so the owner can handle consumer notification.
Penalties and Private Lawsuits
Section 1798.150 lets consumers sue businesses directly when a breach exposes unencrypted personal information because of inadequate security, without first needing a regulatory finding against the company.10California Legislative Information. California Civil Code 1798.150
Statutory damages run $100 to $750 per consumer per incident, or actual damages if those are higher. The per-person math is where this gets expensive fast: a breach affecting 100,000 consumers could produce statutory damages of $10 million to $75 million. Courts set the specific amount within that range by weighing factors like the seriousness of the misconduct, the number of violations, how long they lasted, and the company’s financial position. Class actions are permitted, which is why large California breaches routinely generate multimillion-dollar litigation.
The 30-Day Cure Window
Before filing suit for statutory damages, a consumer must give the business 30 days’ written notice identifying the specific CCPA provisions violated. If the business cures the violation in that window and provides a written statement confirming the fix and pledging no further violations, the consumer cannot proceed on statutory damages. The cure has to be real. Simply tightening security after a breach does not qualify unless the business can explain how the changes address the specific violation identified in the notice.
Evidence Courts Look At
In Section 1798.150 litigation, courts evaluate the actual security practices in place at the time of the breach. Recurring questions include whether the company stored data on internet-accessible systems without adequate safeguards, whether it destroyed data it no longer needed, whether it encrypted personal information, and whether its email filtering effectively blocked phishing. Businesses with documented adherence to the CIS Controls or a comparable framework are in a far stronger position than those reconstructing their posture after the fact.
Administrative Fines
Separate from private lawsuits, the California Privacy Protection Agency can bring administrative enforcement against any business, service provider, contractor, or other person that violates the CCPA. Base penalties are $2,500 per violation or $7,500 per intentional violation and per violation involving data of consumers the business knows are under 16.11California Legislative Information. California Civil Code 1798.155 These amounts are adjusted for inflation every odd-numbered year; the 2025 figures are $2,663 and $7,988.12California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases
Fines are assessed per violation, and each affected consumer can count as a separate violation. A failure exposing 50,000 records could theoretically generate penalties in the hundreds of millions. Settlements are the usual outcome, but the per-violation math gives the CPPA substantial leverage. Unlike the private right of action, administrative enforcement is not limited to breaches: the CPPA can pursue penalties for any CCPA violation, including failure to honor opt-out requests, failure to complete required risk assessments, or missed cybersecurity audit certifications. A business facing both tracks at once is not double-counting a single pool; the two operate independently.