Compliance Stuff

  In July 2025, the California Privacy Protection Agency (CPPA) Board unanimously approved new regulations pursuant to the California Consumer Privacy Act (CCPA) that specifically address the use of automated decisionmaking technologies (ADMTs), requirements for completing risk assessments, and, for businesses processing large amounts of California resident data or engaging in the large-scale sale or sharing of data, mandatory annual cybersecurity audits. While these regulations have been in the drafting process since 2023, they reflect an ongoing trend in California and across the country in favor of heightened, proactive accountability mandates. Quick Hits The CPPA Board recently approved new cybersecurity audit regulations that, pending final approval by the California Office of Administrative Law (OAL), will apply to large CCPA-covered businesses and data brokers. The regulations include extensive independent audit requirements that will, at a minimum, necessitate businesses e...

California regulators recently adopted regulations regarding automated-decision systems (ADS) in the workplace, aiming to protect against employment discrimination given the dramatic rise in artificial intelligence use in employment. On March 21, the California Civil Council of the Civil Rights Department (CRD) voted to approve the rules, which now must be cleared by the Office of Administrative Law (OAL) and published by the Secretary of State. If they pass these final hurdles, they will likely become effective on July 1. Read on for key takeaways from the updated regulations and three steps you should take to stay compliant. Brief Background Employers are increasingly using AI tools during the employee lifecycle. They bring obvious advantages, such as saving time, processing efficiencies, and providing insightful data on people analytics . On the flipside, they can lead to potential discriminatory practices without proper oversight and governance. California leads the way in proposed...