Processing Risk, Not Business Size, Triggers CCPA Risk Assessments

California’s new CCPA risk-assessment requirements can create an easy misconception: large company equals risk assessment.

That is not how the requirement works.

A company’s size or revenue may help determine whether the CCPA applies to the business in the first place. But once a business is in scope, Article 10 asks a different question:

What are you doing with consumers’ personal information?

The California Privacy Protection Agency’s regulations identify specific processing activities that present significant risk to consumers’ privacy.

For a CCPA-covered business, any one of the six processing categories identified in Section 7150 is enough to trigger a risk assessment for that processing activity.

The analysis is better understood as two gates:

Gate 1: Does the CCPA apply to the business?

↓

Gate 2: Does the business engage in processing covered by Section 7150?

↓

If yes: Conduct and document the required risk assessment.

Start With CCPA Scope

Before asking whether you need a CCPA risk assessment, determine whether your organization is subject to the CCPA.

This is a separate analysis.

CCPA applicability considers more than processing risk. The statutory definition of a “business” considers factors including doing business in California, determining the purposes and means of processing consumers’ personal information, applicable revenue or processing thresholds, corporate relationships, and exemptions.

AuditDIFF already has a CCPA Applicability Assessment designed to help document that first determination.

Treat that determination as an ongoing compliance practice, not a one-time exercise. The CCPA does not require businesses to perform an annual applicability assessment. AuditDIFF recommends reviewing and documenting the determination at least annually, and sooner when material facts change. Revenue, California consumer volume, business models, acquisitions, data practices, exemptions, and corporate relationships can all change the answer.

A recurring determination helps reduce the risk of quietly growing into a legal obligation without recognizing it. It also creates stronger audit evidence by showing when applicability was considered, what facts supported the conclusion, who reviewed it, and when the organization plans to reconsider it.

If you have not established that the CCPA applies to your organization, start there.

If the answer is yes, the next question is not how large your company is. It is what you do with personal information.

One Trigger Is Enough

Section 7150 does not require a business to meet several risk factors before a risk assessment becomes mandatory.

For a CCPA-covered business, any one of the six Section 7150 processing categories is sufficient to trigger a risk assessment for that processing activity.

The regulation states that each listed processing activity presents significant risk to consumers’ privacy.

This is an OR test, not an AND test.

You do not need to sell personal information and process sensitive information and use ADMT. One applicable category is enough.

There are exceptions and details within individual categories, particularly the limited exception for certain sensitive employee and independent-contractor information. Those details should be evaluated after identifying the potential trigger.

The Six Processing Categories

1. Selling or sharing personal information

Selling or sharing consumers’ personal information triggers a risk assessment.

Remember that “sharing” has a specific meaning under the CCPA and includes sharing personal information for cross-context behavioral advertising. A business does not necessarily need to receive money for a data disclosure to fall within the CCPA’s sale or sharing rules.

2. Processing sensitive personal information

Processing sensitive personal information generally triggers an assessment.

Sensitive personal information can include information such as precise geolocation, racial or ethnic origin, certain financial account information, genetic data, biometric information processed for identification, and information concerning a consumer’s health or sex life.

There is a narrow exception for specified processing of employee and independent-contractor sensitive personal information when it is used solely and specifically for certain employment-administration purposes, including compensation, employment authorization, benefits, legally required reasonable accommodations, and wage reporting.

The exception should not be mistaken for a general employment-data exemption.

3. Using ADMT to make a significant decision

Using automated decisionmaking technology, or ADMT, to make a significant decision concerning a consumer requires a risk assessment.

This can reach decisions involving areas such as employment, education, lending, housing, insurance, healthcare and other significant opportunities.

It is also important to distinguish this trigger from merely using software or AI somewhere in a workflow. Under the final regulations, ADMT involves technology that replaces or substantially replaces human decisionmaking.

4. Certain automated inferences in employment and education

A risk assessment is required when automated processing is used to infer or extrapolate specified characteristics about a person based on systematic observation while that person is acting as an educational-program applicant, job applicant, student, employee or independent contractor.

The covered inferences include characteristics such as intelligence, ability, aptitude, work performance, economic situation, health, preferences, interests, reliability, behavior, location and movements.

This means an organization should look beyond systems formally labeled “AI.” Workforce monitoring, analytics and profiling technologies deserve attention too.

5. Certain automated inferences based on sensitive locations

Automated processing used to infer or extrapolate specified characteristics based on a consumer’s presence in a sensitive location also triggers an assessment.

There is a practical exception for using personal information solely to deliver goods to, or provide transportation for, a consumer at a sensitive location.

6. Using personal information to train specified technologies

The requirement also reaches certain AI development activities.

A business must conduct a risk assessment when it processes consumers’ personal information that it intends to use to train:

• ADMT that will make significant decisions about consumers;
• facial-recognition technology;
• emotion-recognition technology; or
• other technology used to verify identity or conduct physical or biological identification or profiling.

This trigger is particularly important for AI governance teams because the risk-assessment obligation can begin during model development rather than only when a finished system is deployed.

Quick Screening Table

The last two rows are important.

Revenue and business size are not independent Article 10 risk-assessment triggers.

Another Myth: We Decide Whether the Processing Is Risky Enough

Article 10 does require the assessment itself to weigh privacy risks against benefits. But that balancing exercise comes after determining that the processing falls within Section 7150.

A business should therefore be careful about reasoning:

“We process sensitive personal information, but our controls are excellent, so we determined the processing is low risk and skipped the assessment.”

That reverses the process.

California has already classified processing sensitive personal information as presenting significant risk for purposes of Article 10, subject to the narrow exception discussed above.

The assessment is where the business documents the processing, identifies potential negative impacts, considers safeguards, weighs the risks against benefits and decides whether the processing should proceed.

Good safeguards affect the assessment. They do not necessarily eliminate the obligation to perform it.

What Happens If One Applies?

If one of the six categories applies, continue to Part 2 of this series.

The existing CCPA Risk Assessments guide explains what the assessment must document, who should participate, when assessments must be completed or updated, retention requirements, submission obligations, and how existing assessments may be reused.

The Missing Record: “We Checked”

AuditDIFF has previously recommended documenting the determination of whether the CCPA applies rather than allowing scope to remain an undocumented assumption.

The same governance principle makes sense here.

A business may determine that it is subject to the CCPA but currently does not perform any processing identified in Section 7150. That conclusion is worth recording.

A useful determination could capture:

• company and business unit;
• assessment date;
• confirmation of CCPA applicability;
• whether personal information is sold or shared;
• whether sensitive personal information is processed and for what purposes;
• whether ADMT makes significant decisions;
• whether covered automated inference occurs;
• whether covered sensitive-location processing occurs;
• whether personal information trains covered technologies;
• findings and explanatory notes;
• evidence or systems reviewed;
• person completing the determination;
• reviewer or approver; and
• date or event that will trigger reassessment.

That is not the same thing as a full Article 10 risk assessment.

It is the record showing that the organization considered whether Article 10 requires one.

For privacy and GRC teams, that distinction is useful. Not every CCPA-covered business will need an assessment for every processing activity. But every covered business should know enough about its processing to determine which obligations it actually triggers.

That is how scope becomes governance rather than guesswork.