The California Privacy Protection Agency (CPPA) finalized crucial regulations in July 2025, defining mandatory compliance requirements around Automated Decision-Making Technology (ADMT), comprehensive risk assessments, and cybersecurity audits. This session dissects these finalized rules, offering practical strategies to implement the new "Privacy Pillars" for successful outcomes. We will clarify the newly narrowed scope of ADMT compliance, which now focuses primarily on systems that substantially replace human decision-making for significant decisions. The discussion will detail the specific processing activities that trigger mandatory risk assessments, such as processing sensitive personal information, profiling based on sensitive location, or high-risk selling/sharing. Furthermore, we will review the updated requirements for cybersecurity audits, triggered by specific revenue and processing thresholds, including utilizing standards like the NIST Cybersecurity Framework 2.0. Participants will gain concrete steps for modifying existing Privacy Impact Assessments (PIAs), preparing for staggered audit deadlines (2028-2030), and ensuring proper executive management accountability for compliance. Prepare your organization for the critical compliance deadlines beginning in 2027.

 Learning Objective

After completing this session, participants will be able to:

1. Evaluate existing Automated Decision-Making Technology (ADMT) systems to determine whether they meet the finalized standard of substantially replacing human decision-making for significant decisions, requiring consumer opt-out mechanisms or exceptions.

2. Determine specific processing activities that trigger a comprehensive California risk assessment, including the processing of sensitive personal information or the use of ADMT for training that will render a significant decision.

3. Outline organizational strategies for engaging qualified, objective, and independent auditors and initiating cybersecurity audit readiness reviews, leveraging established standards like AICPA or ISACA, based on the required staggered timelines.

4. Develop a plan to modify existing Privacy Impact Assessment (PIA) programs to capture the unique requirements of the CPPA risk assessment, including detailing the risk-benefit analysis and designating appropriate internal reviewers.