1. (a) Every business whose processing of consumers' personal information presents significant risk to consumers' security as set forth in subsection (b) must complete a cybersecurity audit.

2. (b) A business's processing of consumers' personal information presents significant risk to consumers' security if any of the following is true:

   1. (1) The business meets the threshold set forth in Civil Code section 1798.140, subdivision (d)(1)(C), in the preceding calendar year; or

   2. (2) The business meets the threshold set forth in Civil Code section 1798.140, subdivision (d)(1)(A); and

      1. (A) Processed the personal information of 250,000 or more consumers or households in the preceding calendar year; or
      2. (B) Processed the sensitive personal information of 50,000 or more consumers in the preceding calendar year.

Note: Authority cited: Section 1798.185, Civil Code. Reference: Section 1798.185, Civil Code.

History

1. Renumbering of former article 9 (sections 7300-7304) to article 13 and new article 9 (sections 7120-7124) and section filed 9-22-2025; operative 1-1-2026 (Register 2025, No. 39).