CPPA preview: Cybersecurity audit regs nearing formal proposal
By 
Adrianne Appel2024-01-09T20:16:00
Companies with business in California could face tough new cybersecurity mandates under draft regulations that are soon headed for formal rulemaking.
The California Privacy Protection Agency (CPPA) is expected to vote as early as Friday to launch the formal rulemaking process for a series of cybersecurity audit requirements on businesses. Once approved for formal rulemaking, the draft regulations would be open 45 days for public comment before being finalized. Businesses would then have two years to come into compliance with the rules.
Two other packages of draft rules, one on data risk assessments and another on automated decision-making technology, are still being debated by the five-member CPPA, which was tasked with writing and enforcing privacy rules under amendments to the California Consumer Privacy Act passed in 2020.
THIS IS MEMBERS-ONLY CONTENT
You are not logged in and do not have access to members-only content.
If you are already a registered user or a member, SIGN IN now.
Related articles
-
PremiumWhat’s on tap for CPPA from its deputy director of enforcement
Michael Macko, deputy director of enforcement at the California Privacy Protection Agency, described priorities for the agency now and in the near future during a recent board meeting.
-
News BriefCPPA warns of collecting too much data in first enforcement advisory
The California Privacy Protection Agency warned businesses to stop asking for excessive information from consumers who have requested to opt out of having their data collected or who are otherwise exercising their privacy rights under the California Consumer Privacy Act.
-
News BriefCalif. AG launches sweep into streaming apps’ compliance with CCPA
California Attorney General Rob Bonta announced the launch of an investigative sweep targeting popular streaming apps and devices, alleging noncompliance with the California Consumer Privacy Act.
More from Regulatory Policy
-
ArticleCompliance must focus on corruption as EU and U.K. seek to tackle rising risks
Corruption isn’t something that happens somewhere else, in other countries and committed by other people. Nowhere is corruption-proof, and new rules being introduced in the EU and the U.K. aim to focus compliance officers on the full gamut of risks in all jurisdictions and every sector.
-
ArticleEmployment law in the age of AI: Compliance considerations
Employment law in the age of AI is evolving faster than many companies can keep pace. As more states enact AI laws and as more case law piles on, chief compliance officers and in-house counsel must ensure that compliance policies and procedures evolve as AI legal and compliance risks evolve.
-
ArticleCompliance must future-proof AI projects to meet evolving regulations
AI implementations are surging, but many new systems are being abandoned after companies have invested in expensive projects. Now evolving AI regulation is adding to the list of reasons why new systems may fail. Compliance must watch emerging regulatory developments and ensure that any new AI tools are capable of ...