Skip to main content

CCPA risk assessment report template

Every element § 7152 of the CCPA regulations requires, in the order the regulation lists them. Copy it into your own document, fill in one copy per processing activity, and attach the evidence.

Last reviewed November 2026. Based on the CPPA regulations in effect January 1, 2026 (Cal. Code Regs. tit. 11, §§ 7150–7157).

The short version

  • One report per processing activity, or per comparable set of activities with similar risks.
  • Purpose and benefits must be specific. Generic phrases like "to improve our services" do not qualify.
  • Fields marked Papaya evidence are facts about how your site behaves, which a browser run can show.
  • Legal counsel who gave legal advice is left out of the contributor and approver lists.

How to use this template

Start with the trigger. If you are not sure which of the six § 7150(b) activities apply, run the applicability check first. Then work through the fields with the people who run the processing, as § 7151 requires. Record a decision and get sign-off from someone with authority to decide whether the processing begins.

The template

Processing activity3 fields

  • Trigger§ 7150(b)
    Which of the six significant-risk activities this assessment covers. Note if the processing began before January 1, 2026.
  • Purpose§ 7152(a)(1)
    The specific purpose of the processing. Avoid generic terms like "to improve our services" or "security purposes."
  • Categories of personal information§ 7152(a)(2)
    Each category of personal and sensitive personal information processed, and the minimum needed to achieve the purpose.Papaya evidenceNetwork requests and cookies show which data leaves your pages.

Operational elements7 fields

  • Collection, use, disclosure, retention§ 7152(a)(3)(A)
    The planned method for collecting, using, disclosing, retaining, or otherwise processing the information, and its sources.Papaya evidenceBrowser runs record which scripts collect what, on which pages.
  • Retention§ 7152(a)(3)(B)
    How long each category is kept, or the criteria used to decide.
  • Method of interacting with consumers§ 7152(a)(3)(C)
    How you interact with the consumers whose information is processed (for example, websites, apps, or offline) and why.
  • Approximate number of consumers§ 7152(a)(3)(D)
    Roughly how many consumers' information will be processed.
  • Disclosures to consumers§ 7152(a)(3)(E)
    What you have told or will tell consumers about the processing, and how (for example, a just-in-time notice).Papaya evidenceScreenshots of the banner, notices, and opt-out link at each step.
  • Service providers, contractors, third parties§ 7152(a)(3)(F)
    Names or categories of the service providers, contractors, or third parties the information is disclosed to or made available to, and the purpose.Papaya evidenceReceiving domains, captured before and after each consent choice.
  • ADMT logic and output§ 7152(a)(3)(G)
    For ADMT used for significant decisions: the logic, including assumptions and limitations, and the output and how it will be used.

Benefits, impacts, and safeguards3 fields

  • Benefits§ 7152(a)(4)
    Specific benefits to the business, consumers, other stakeholders, and the public.
  • Negative impacts§ 7152(a)(5)
    Negative impacts to consumers' privacy and their sources and causes. Consider unauthorized access, discrimination, impaired control, coercion or dark patterns, and economic, physical, reputational, and psychological harms.Papaya evidenceTags that keep firing after reject-all or a GPC signal, with the requests as proof.
  • Safeguards§ 7152(a)(6)
    The safeguards you will implement to address the negative impacts, such as encryption, privacy-enhancing technologies, consulting external parties, and policies and training.Papaya evidenceRerunnable tests showing whether opt-outs and GPC handling work.

Decision and sign-off4 fields

  • Decision to proceed§ 7152(a)(7)
    Whether the business will initiate the processing. If the risks outweigh the benefits, restrict or do not proceed (§ 7154).
  • Contributors§ 7152(a)(8)
    The individuals who provided information for the assessment, excluding legal counsel who provided legal advice.
  • Review and approval§ 7152(a)(9)
    Date reviewed and approved, and the names and positions of reviewers and approvers, including someone with authority to decide whether the processing begins. Legal counsel giving legal advice is excluded.
  • Review schedule§ 7155
    Next review date (at least every three years) and the owner who watches for material changes requiring an update within 45 calendar days.

Writing tips

  • Be specific about purpose. The regulation's own contrast: "improving the service" is too vague, while naming what you improve and how is not.
  • Tie impacts to causes. Section 7152(a)(5) asks for the sources and causes of each negative impact, not only a list of harms.
  • Show that safeguards work. A safeguard you cannot demonstrate is a plan. Test results, kept with the report, show it is real.
  • Plan for change. A new tag, vendor, or purpose can be a material change with a 45-day update clock. Decide now who watches for it.

See the full Article 10 requirements for context on each section.

Questions, answered.

The CPPA has not published a required form. Section 7152 lists what the assessment must contain, and this template follows that list in order.

Sources

This guide summarizes the regulations for planning purposes. It is not legal advice. Papaya provides technical evidence; your counsel makes the legal calls.

More on Article 10

How Papaya helps

Fill the evidence fields with facts.

We'll run real consent journeys on your site and show you how the results map to the operational, impact, and safeguard fields of this template.

  • A live run of reject-all, accept-all, and GPC journeys on your site
  • How each piece of evidence maps to the fields in § 7152
  • Which of your vendors receive data in each consent state
Which processing do you need to assess?

We use your details only to reply about your request.