CCPA risk assessment evidence checklist

What makes the assessment specific?

California regulations section 7150 identifies covered processing. Section 7152 requires a documented assessment and rejects generic purpose descriptions.

Section 7155 requires an assessment before new covered processing begins. Covered processing started before January 1, 2026 and continuing afterwards needs assessment by December 31, 2027.

Review at least every three years. Update after a material change as soon as feasible, within 45 calendar days.

The user confirms coverage for this preflight. Missing scope evidence requires review, not an automatic “not required” conclusion.

Worked example. A cross-context advertising activity

Fictional example. Harbour Retail proposes sharing browsing segments with an advertising partner to measure campaign responses across websites.

The record names the events, recipients, retention period and intended measurement benefit. It does not stop at “marketing analytics”.

One identified risk is unexpected cross-context profiling. Link that risk to proposed minimisation, opt-out handling and recipient-use restrictions.

A contract description alone cannot prove that restrictions operate. Attach implementation or testing evidence and assign any missing facts.

The reviewer records remaining risks, benefits and reasons. This example demonstrates a record structure, not approval of the activity.

Describe the processing before rating it

Record the purpose, technology, data, affected people, scale, recipients and lifecycle. Flag missing facts rather than silently assuming them.

Connect risks to controls and evidence

For each material risk, record the affected interest, likelihood basis, severity basis, existing safeguard, evidence reference and remaining action.

• Purpose and necessity
• Data minimisation and retention
• Access and security
• Consumer choice and transparency
• Automated decision or profiling effects

Keep the decision reviewable

Name the reviewer, decision, approval date, conditions, next review trigger and unresolved question. The tool should support that record without making the final legal decision.

Working checklist and fictional samples

Use this checklist as an operating aid, not an exhaustive legal assessment. Inspect the samples before entering your own facts.

• State the specific purpose, processing stages, data and affected consumers.
• Identify who benefits and the basis for each claimed benefit.
• Describe privacy harms and the evidence behind their assessment.
• Link safeguards to operating evidence and unresolved weaknesses.
• Record the decision-maker, conditions and activity-specific review triggers.

• Fictional CCPA assessment PDF. Complete fictional pack (ZIP). Inspect supplied facts, assessment fields and unresolved review.
• Fictional CCPA assessment workbook XLSX. Review the editable evidence structure alongside the report.