California\u2019s privacy law reaches any business meeting one of its thresholds, wherever it is based. New regulations on audits, risk assessments and automated decisions took effect on 1 January 2026.
What is the CCPA?
The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to a for-profit business that does business in California and meets any one of three thresholds: annual gross revenue above roughly 26.6 million dollars, a figure adjusted annually for inflation; deriving half or more of annual revenue from selling or sharing personal information; or handling the personal information of 100,000 or more California residents or households in a year.
Meeting one threshold is enough, and where the business itself is located does not matter. A UK company with no US entity is in scope if it processes enough Californian personal information, in the same way GDPR reaches companies with no European presence. Enforcement sits with the California Privacy Protection Agency, a dedicated regulator, alongside the Attorney General.
The CPRA amendments added rights over sensitive personal information, a right to correction, and contractual obligations flowing down to service providers and contractors. New regulations approved for 1 January 2026 go further, introducing requirements for cybersecurity audits, risk assessments and automated decision-making technology, with phased timelines for those three. Civil penalties run to 2,500 dollars per violation, and 7,500 dollars where the violation is intentional.
Compliance requirements
Obligations owed to California residents, most of which map onto work an existing GDPR programme has already done.
Consumers told, at or before the point of collection, what categories of personal information are collected, why, and how long they are kept.
On request, disclose the categories and specific pieces of personal information collected, the sources, the purpose, and who it was shared with.
Deletion on request, with the request passed to service providers and contractors, and correction of inaccurate personal information.
A clear mechanism to opt out of the sale or sharing of personal information, including honouring opt-out preference signals sent by a browser.
A right to restrict use of sensitive categories to what is necessary to provide the service.
Specific contractual terms flowing down the chain. A standard supplier agreement will not contain them.
Introduced by the regulations effective 1 January 2026, on phased timelines, for businesses whose processing presents significant risk.
Notice, opt-out and access obligations where ADMT is used in significant decisions, also phased under the 2026 regulations.
Audit process
Netru manages the complete CAF compliance journey, from determining applicability through to competent authority submission and ongoing improvement.
We establish whether you actually meet one of the three thresholds, because a good number of businesses assume they are in scope when they are not, and the reverse.
We map what Californian personal information you hold, where it came from, who you share it with, and whether any of it counts as a sale or a share.
We assess against the current regulations including the 2026 additions, and reuse everything an existing GDPR programme already satisfies.
Your compliance manager builds the notice at collection, the opt-out mechanism including preference signal handling, and a working rights request process.
We update service provider and contractor terms so the obligations actually flow down the chain.
Where the 2026 regulations bite, we run the risk assessments and prepare for the cybersecurity audit requirement on its phased timeline.
How Netru delivers it
Our UK-based team has deep experience in the NCSC CAF and NIS Regulations compliance. We assess your posture against all CAF objectives, implement improvements, complete your self-assessment, and manage the competent authority submission process.
Talk to our teamBefore you talk to anyone