California's privacy law reaches more small and midsize companies than most owners expect, and the parts that trip businesses up are rarely the privacy policy on the website. They are the IT parts: knowing where personal information lives, answering a deletion request on time, proving your security was reasonable after a breach, and holding vendors to the right contract terms. This CCPA compliance checklist covers who the law applies to as of October 2026, what the 2026 regulations added, and the technical work behind each rule. It is guidance from an IT provider, not legal advice.
Does the CCPA apply to your business? The three thresholds in force for 2026
The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to for profit businesses that do business in California, collect personal information about California residents, and meet at least one of three tests. The first is annual gross revenue above $26,625,000 in the preceding calendar year. That figure started at $25 million, and the California Privacy Protection Agency raised it to $26,625,000 effective January 1, 2025, to track inflation. The second test is buying, selling, or sharing the personal information of 100,000 or more California consumers or households a year. The third is earning 50 percent or more of annual revenue from selling or sharing personal information.
Two details catch owners off guard. The agency adjusts its dollar figures in January of every odd numbered year, so a new revenue threshold is due in January 2027, and it is worth checking the CPPA page when it appears. And "consumer" means any California resident, which since January 1, 2023 includes your own employees, job applicants, and business contacts. The 100,000 test is also easier to reach than it sounds, because advertising pixels on a busy website can count as sharing visitor data.
Step one: build a data map before you write a single policy
Every other item here depends on knowing what personal information you hold, where it sits, who can reach it, and which vendors receive it. For a typical office it covers Microsoft 365 mailboxes and file shares, the main business application, accounting and payroll, backups, laptops and phones, and every cloud tool someone signed up for with a company card.
Record the categories of data in each system, with extra care for sensitive personal information such as Social Security and driver's license numbers, account credentials, precise geolocation, and health details. Then note how long you keep each one. The CCPA expects you to keep personal information only as long as reasonably necessary for the purpose you disclosed, which is hard to show without a written data retention policy. If you already sort information by sensitivity, a simple data classification scheme makes the map far faster to build and keep current.
Step two: handle access, deletion and correction requests on the clock
Consumers can ask to know what you hold about them, to delete it, to correct it, and to opt out of its sale or sharing. Under the regulations you must confirm receipt of a request to know, delete, or correct within 10 business days and respond within 45 calendar days, with one further 45 day extension if you tell the consumer why. The Attorney General's CCPA guidance adds that you must offer at least two ways to submit requests, usually a web form and a toll free number, and that you cannot force someone to create an account just to make one. Opt out requests carry a shorter limit of 15 business days.
The hard part for IT is deletion. Removing a person from your CRM does nothing about the same record in an old spreadsheet export, an email thread, or the backup set. Write a runbook that lists each system from your data map and how deletion works in each, including backups that cannot be edited record by record. Log every request and its outcome.
Verification has to be proportionate, too. In March 2025 the CPPA fined American Honda $632,500, partly because its web form demanded more information than necessary to process opt out requests and required verification where the law did not allow it. The order also required Honda to honor the Global Privacy Control browser signal. If your website runs ad pixels, that signal is a technical setting someone needs to own.
Step three: reasonable security, the part a breach puts on trial
The CCPA lets consumers sue when certain personal information is stolen in unencrypted and unredacted form because the business failed to maintain reasonable security. After the inflation adjustment, statutory damages run from $107 to $799 per consumer per incident, or actual damages if greater. For 5,000 stolen customer records, the top of that range approaches $4 million.
The statute does not define reasonable security, but California has given hints. The Attorney General's 2016 data breach report called the Center for Internet Security's Critical Security Controls the minimum level of security for any organization holding personal information. The 2026 cybersecurity audit regulations go further and list what an audit must examine: multifactor authentication, including phishing resistant MFA, encryption of personal information at rest and in transit, least privilege access, asset and data inventories, patching and secure configuration, vulnerability scanning and penetration testing, logging, network monitoring, antimalware, security training, vendor oversight, secure disposal, incident response, and business continuity. Even if you never file an audit, that list is the clearest public picture of what California treats as reasonable.
Encryption deserves its own line on your checklist, because the private right of action turns on data stolen in nonencrypted form. Full disk encryption on laptops and encrypted backups remove much of the exposure at low cost. Pair that with a written incident response plan, because California's breach notification law now gives businesses 30 calendar days from discovery to notify affected residents, a deadline that took effect on January 1, 2026.
Step four: put the right terms in your vendor contracts
When you hand personal information to a payroll service, a marketing platform, an IT provider, or a cloud backup company, the CCPA expects a written contract that limits what that vendor can do with it. Service provider and contractor agreements need to name the specific business purposes, prohibit selling or sharing the data, bar its use outside the direct relationship with you, require the vendor to protect it to the standard the law sets for you, and give you the right to stop unauthorized use.
Start with the vendor list from your data map, pull each agreement, and flag the ones silent on these points. A structured third party risk management process keeps this from turning into a scramble every time a new tool appears.
Step five: know whether the 2026 audit and risk assessment rules reach you
New CCPA regulations on cybersecurity audits, risk assessments, and automated decisionmaking technology took effect on January 1, 2026, after the Office of Administrative Law approved them in September 2025. They phase in over several years, as the August 2026 summary from Alston and Bird explains.
The audit requirement applies to businesses whose processing presents a significant risk to consumers' security. That means either earning at least half of annual revenue from selling or sharing personal information, or exceeding the revenue threshold while processing the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers, in the prior year. First audit certifications are due April 1, 2028 for businesses above $100 million in revenue, April 1, 2029 for those between $50 million and $100 million, and April 1, 2030 for those under $50 million. The auditor must be qualified and independent, and may not have built or run the program under review. So the company that manages your security cannot also audit it.
Risk assessments depend on activity rather than size. Selling or sharing personal information, processing sensitive personal information (with a narrow exception for routine payroll and benefits), and using automated decisionmaking technology for significant decisions all trigger one. New high risk processing needs an assessment before it starts. Processing already underway must be assessed by December 31, 2027, and the first summary and attestation go to the CPPA by April 1, 2028. Businesses that use automated decisionmaking technology for significant decisions about people, such as hiring, face a separate compliance date of January 1, 2027.
Step six: train the people who touch requests and data
The regulations expect the people who handle consumer inquiries to know the rules. Train the front desk, customer service, and HR to recognize a privacy request that arrives by phone or email, and train everyone on phishing, since a stolen login starts many breaches. Keep the records. Administrative fines reach $2,663 per violation and $7,988 per intentional violation, and records separate an honest mistake from neglect.
How GlobeVM helps California businesses with the IT side of CCPA
GlobeVM has supported businesses for 30 years and looks after more than 75 organizations across Southern California. We handle the technical layer of privacy compliance: the data map, Microsoft 365 hardening, encryption, and documented controls your attorney can rely on. Firewall management, endpoint protection, email filtering, and multifactor authentication come standard in every plan, with 24/7 monitoring behind them. When you call, a person in Los Angeles answers in under 15 minutes, often George or Nazy, the owners, in English or Farsi.
Read more about our compliance and risk management services, or get a quick read on your current posture with our free security score tool. For a full review of where personal information sits and how well it is protected, book a free IT assessment or call (818) 405-9930.
CCPA compliance questions small business owners ask us
Does the CCPA apply if our revenue is under $26.6 million?
It can. The revenue test is only one of three. If you buy, sell, or share the personal information of 100,000 or more California consumers or households a year, or earn half your revenue from selling or sharing it, the law applies regardless of revenue.
Do we have to complete a CCPA cybersecurity audit?
Only if your processing meets the significant risk tests in the 2026 regulations: half your revenue from selling or sharing data, or revenue over the threshold combined with 250,000 consumers' personal information or 50,000 consumers' sensitive personal information. Qualifying companies under $50 million in revenue have until April 1, 2030.
How long do we have to respond to a deletion request?
Confirm receipt within 10 business days and give a substantive response within 45 calendar days. One 45 day extension is allowed with notice and a reason.
Does the CCPA cover employee data?
Yes. Since January 1, 2023, employees, job applicants, and business contacts have the same rights as customers.