Quick Summary
The California Consumer Privacy Act, or CCPA, now requires an annual independent cybersecurity audit from businesses whose use of personal information presents a significant risk, including many retailers with loyalty programs and online stores. Retailers that generate more than $100 million in revenue must certify by April 1, 2028.
Loyalty programs know names, addresses, purchase histories, payment cards and, if you have and use an app, roughly where members are located. Multiply that by a few hundred thousand California shoppers and a new state requirement may apply to you.
Under regulations the California Privacy Protection Agency finalized in 2025, businesses covered by the CCPA that meet a significant-risk test must complete an independent cybersecurity audit every year, and an executive must certify it under penalty of perjury. The state now wants proof that your privacy promises hold up.
Does the Cybersecurity Audit Apply to Your Business?
The audit applies if your business earns 50% or more of its revenue from selling or sharing personal information, or if it has more than $26,625,000 in annual gross revenue and, in the prior year, processed the personal information of 250,000 or more consumers or households or the sensitive personal information of 50,000 or more consumers.
Retailers can reach the second test faster than they expect, since loyalty members, online accounts and employee records all count toward the threshold.
When Are CCPA Cybersecurity Audits Due?
Deadlines are phased by revenue, and each audit covers a full year.
| Annual Gross Revenue | First Certification Due | Audit Period |
|---|---|---|
| Over $100 million (2026) | April 1, 2028 | Calendar year 2027 |
| $50 million to $100 million (2027) | April 1, 2029 | Calendar year 2028 |
| Under $50 million (2028) | April 1, 2030 | Calendar year 2029 |
An executive certifies completion online each year, and the report and workpapers are kept for at least five years.
What Will the Auditor Test?
The auditor tests whether your security controls operated through the year. The regulations don’t mandate a framework, but they list what a program should cover, including access controls, multifactor authentication, encryption, logging, vendor oversight and incident response.
Payment Card Industry Data Security Standard testing often covers much of that list, so most retailers can start by mapping existing evidence to the CCPA and finding gaps early.
What Retail Leaders Should Do Now
- Run the significant-risk test. Count consumers and sensitive records across stores, e-commerce, loyalty and human resources systems. The count doubles as the start of your data map.
- Reuse the evidence you have. Match existing payment card testing to the CCPA’s list.
- Decide who signs. Name the certifying executive and the leads who support them.
- Start collecting evidence on Jan. 1, 2027. For retailers over $100 million, that’s day one of the first audit period.
Frequently Asked Questions
What Are the Penalties for Violating the CCPA?
CCPA penalties run up to $2,663 per violation and $7,988 per intentional violation, as adjusted by the California Privacy Protection Agency in 2025. When unencrypted personal information is breached because security wasn’t reasonable, consumers can also sue for $107 to $799 each per incident.
Do Retailers Outside California Need a CCPA Cybersecurity Audit?
Retailers headquartered outside California can still need a CCPA cybersecurity audit. The law applies to for-profit businesses that do business in California and meet its thresholds, wherever they’re based, so a Pennsylvania chain with California online customers or employees may qualify.
Can an Internal Team Perform the CCPA Cybersecurity Audit?
An internal auditor can perform the CCPA cybersecurity audit if they’re qualified and independent, which means reporting to the board or a similar governing body rather than to the managers of the cybersecurity program. Many businesses use an outside firm to keep that independence clear.
How Schneider Downs Can Help
Schneider Downs’ IT Risk Advisory Services and Cybersecurity teams support CCPA audit readiness and the audit itself, from data mapping to independent testing. Contact our team to talk through where you stand.
