Submitting to the CPPA by April 1, 2028

When the submission is due

• Assessments conducted in 2026 and 2027: submit by April 1, 2028 (§ 7157(a)(1)). This includes assessments of processing that began before 2026, which are due by December 31, 2027.
• Assessments conducted after 2027: submit by April 1 of the following year. Assessments done in 2028 are reported by April 1, 2029 (§ 7157(a)(2)).

What you submit

Section 7157(b) lists six items:

1. The business's name and a point of contact, with name, phone number, and email address.
2. The time period covered, by month and year.
3. The number of risk assessments conducted or updated in that period, in total and for each of the six processing activities in § 7150(b).
4. Whether those assessments involved each category of personal information and sensitive personal information defined in the CCPA.
5. The attestation statement below.
6. The name and business title of the person submitting, and the date of certification.

Counting assessments per activity means knowing which trigger each one falls under. Our applicability check walks through the six.

The attestation

The submitter must attest to this statement, quoted from § 7157(b)(5):

“I attest that the business has conducted a risk assessment for the processing activities set forth in California Code of Regulations, Title 11, section 7150, subsection (b), during the time period covered by this submission, and that I meet the requirements of section 7157, subsection (c). Under penalty of perjury under the laws of the state of California, I hereby declare that the risk assessment information submitted is true and correct.”

Who can sign

Under § 7157(c), the submitter must be a member of executive management who:

• Is directly responsible for the business's risk-assessment compliance;
• Has enough knowledge of the risk assessments to provide accurate information; and
• Has the authority to submit the information to the CPPA.

Submissions go through the CPPA's website, cppa.ca.gov (§ 7157(d)).

Requests for the full reports

The CPPA or the Attorney General may require your risk assessment reports at any time. You must deliver them within 30 calendar days of the request (§ 7157(e)). Reports need to be ready to hand over, which is one more reason to keep them current and keep every version for the retention period in § 7155(c).

How to prepare

• Inventory your processing against the six triggers and note which began before 2026.
• Complete each assessment with the elements in § 7152. The template lists them.
• Record which personal information categories each assessment involves, so the submission counts are easy.
• Pick the executive who will sign, and involve them before the deadline, not on it.
• Keep evidence for factual claims, such as how your website collects and shares data, so the reports hold up if requested.

Sources

• CPPA, CCPA regulations effective January 1, 2026 (Cal. Code Regs. tit. 11, §§ 7000 et seq.), PDF
• CPPA, California finalizes regulations to strengthen consumers' privacy (September 23, 2025)
• White & Case, CPPA finalizes rules on ADMT, risk assessments, and cybersecurity audits requirements under the CCPA (September 25, 2025)

This guide summarizes the regulations for planning purposes. It is not legal advice. Papaya provides technical evidence; your counsel makes the legal calls.