CCPA risk assessment evidence checklist
A risk assessment needs traceable facts and reasons. A list of unchecked legal conclusions is not an assessment record.
Describe the processing before rating it
Record the purpose, technology, data, affected people, scale, recipients and lifecycle. Flag missing facts rather than silently assuming them.
Connect risks to controls and evidence
For each material risk, record the affected interest, likelihood basis, severity basis, existing safeguard, evidence reference and remaining action.
- Purpose and necessity
- Data minimisation and retention
- Access and security
- Consumer choice and transparency
- Automated decision or profiling effects
Keep the decision reviewable
Name the reviewer, decision, approval date, conditions, next review trigger and unresolved question. The tool should support that record without making the final legal decision.
Material reviewed for this guide
- CCPA updates, risk assessments, cybersecurity audits and ADMT regulationsCalifornia Privacy Protection Agency
- California privacy regulationsCalifornia Privacy Protection Agency
This guide is general operational information, not legal advice. Check the official material and obtain appropriate advice for circumstances outside the stated scope.