Businesses operating in California will need to meet new, first-in-the-nation privacy requirements for cybersecurity, risk assessments, and automated decision-making technology (ADMT), under a large expansion of rules by the state.
The rules, unanimously approved July 24 by the California Privacy Protection Agency (CPPA), significantly broaden the panel’s oversight of businesses that handle personal data of customers, employees, and the public. These new guidelines aim to strengthen protections for consumers while balancing business concerns, including scaled-back compliance requirements and phased reporting deadlines.
