CPPA seeking comment on cybersecurity audit, risk assessment rule adds

The California Privacy Protection Agency (CPPA) is seeking comment on privacy rules requiring certain large businesses to conduct annual cybersecurity audits and risk assessments if the state believes they are placing consumer data at risk.

The California Privacy Rights Act (CPRA) mandated the agency write cybersecurity audit and risk assessment rules for businesses whose processing of consumer personal data presents “significant risk to consumers’ privacy or security,” according to the CPPA’s request for comments published Friday.

The agency also will write rules concerning use of automated decision-making technology by businesses regarding consumers’ opt-out rights and their access to data.