Data Protection Impact Assessment (DPIA) (CA) - California
California Data Protection Impact and Risk Assessment
| Record field | Entry |
|---|---|
| Project, processing activity, and version | [________________________________] |
| Business entity and owner | [________________________________] |
| Assessment prepared by and date | [________________________________] |
| Planned start or material change | [__/__/____] |
| Review and decision owner | [________________________________] |
| Record custodian and location | [________________________________] |
1. Scope and Required-Assessment Decision
Describe the actual processing before selecting a legal conclusion. The internal impact assessment may be used even when the CCPA risk-assessment article does not apply.
| Scope question | Facts, current official source, and conclusion |
|---|---|
| Is this entity a covered CCPA business for the activity? | [________________________________] |
| What consumers and personal information are involved? | [________________________________] |
| Does the processing sell or share personal information under § 7150(b)(1)? | [________________________________] |
| Does it process sensitive personal information under § 7150(b)(2), and does a stated exception apply? | [________________________________] |
| Does it use ADMT for a significant decision under § 7150(b)(3)? | [________________________________] |
| Does it perform the listed inference processing under § 7150(b)(4) or (5)? | [________________________________] |
| Does it train specified ADMT or biometric technology under § 7150(b)(6)? | [________________________________] |
| Does another jurisdiction, sector rule, contract, or internal policy require an assessment? | [________________________________] |
Decision: ☐ CCPA § 7150 assessment required before processing ☐ Internal assessment only ☐ More facts or legal review required.
Reason, exact source, date checked, and reviewer: [________________________________]
2. Purpose, Data, and Operations
State the specific purpose and expected benefit. Avoid labels such as “improve services” without the actual result being sought.
| Required fact | Assessment entry |
|---|---|
| Specific processing purpose and expected outcome | [________________________________] |
| Categories of personal information, including sensitive categories | [________________________________] |
| Minimum information necessary for the purpose | [________________________________] |
| Sources and collection method | [________________________________] |
| Collection, use, disclosure, storage, and deletion steps | [________________________________] |
| Retention period for each category or the criteria used | [________________________________] |
| Consumer interaction and approximate number affected | [________________________________] |
| Notices already given or planned, and delivery method | [________________________________] |
| Service providers, contractors, third parties, and each disclosure purpose | [________________________________] |
| If § 7150(b)(3) ADMT applies: logic, assumptions, limitations, output, and how it informs the significant decision | [________________________________] |
Data flow or inventory attachment: [FILE / VERSION]
3. Stakeholders and Alternatives
Employees whose duties include participating in processing subject to a risk assessment must be involved under § 7151(a). Record their input and any external input used.
| Participant and role | Input supplied | Date and evidence |
|---|---|---|
| [________________] | [________________] | [________________] |
| [________________] | [________________] | [________________] |
Less intrusive alternatives considered and reason accepted or rejected: [________________________________]
4. Benefits and Privacy Risks
| Beneficiary | Specific benefit and evidence |
|---|---|
| Consumer | [________________________________] |
| Business | [________________________________] |
| Other stakeholders | [________________________________] |
| Public | [________________________________] |
| Negative privacy impact | Source and cause | Affected people | Magnitude / likelihood | Evidence |
|---|---|---|---|---|
| Unauthorized access, use, disclosure, destruction, or loss of availability | [____] | [____] | [____] | [____] |
| Loss of control, misleading notice, or ineffective choice | [____] | [____] | [____] | [____] |
| Inaccurate inference, discrimination, or economic harm | [____] | [____] | [____] | [____] |
| Physical, reputational, psychological, or other harm | [____] | [____] | [____] | [____] |
| Other project-specific risk | [____] | [____] | [____] | [____] |
5. Safeguards and Residual Balance
| Risk addressed | Safeguard and evidence | Owner / completion date | Residual risk |
|---|---|---|---|
| [________________] | [________________] | [________________] | [________________] |
| [________________] | [________________] | [________________] | [________________] |
Do the remaining privacy risks outweigh the benefits to consumers, the business, other stakeholders, and the public? Explain with evidence and unresolved uncertainty: [________________________________]
Processing decision: ☐ Initiate ☐ Initiate after listed conditions ☐ Redesign ☐ Do not initiate.
Decision rationale and any conditions: [________________________________]
6. Review, Record, and Agency Information
| Control | Entry |
|---|---|
| Contributors other than counsel giving legal advice, and their roles | [________________________________] |
| Reviewer with authority to participate in the start decision | [NAME / POSITION] |
| Other reviewers and approval dates | [________________________________] |
| Decision date, version, and evidence location | [________________________________] |
| Next scheduled review, no later than three years if § 7155 applies | [__/__/____] |
| Material-change owner and 45-calendar-day update route if § 7155 applies | [________________________________] |
| Original and updated record retention route under § 7155(c), if applicable | [________________________________] |
| § 7157 Agency information submission owner and due date, if applicable | [________________________________] |
For covered 2026–2027 risk assessments, § 7157(a)(1) calls for submission of the information specified in subsection (b) by April 1, 2028. This document is the assessment record; assign the separate agency submission and attestation to an authorized owner.
Business decision-maker: [SIGNATURE / NAME / TITLE / DATE]
Privacy reviewer: [SIGNATURE / NAME / TITLE / DATE]
Security reviewer: [SIGNATURE / NAME / TITLE / DATE]
California legal reviewer: [SIGNATURE / NAME / TITLE / DATE]
Current Official Sources
- Cal. Civ. Code § 1798.100: https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf
- CPPA approved risk-assessment regulations, 11 CCR §§ 7150–7157: https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf
- CPPA final-rule announcement and phase-in dates: https://cppa.ca.gov/announcements/2025/20250923.html
About this template
- Last updated
- September 27, 2026
- Citations checked
- September 27, 2026
- Jurisdiction
- California
- Category
- Compliance & Regulatory
Legal authority
- Cal. Civ. Code § 1798.100(a), (c)
- Cal. Code Regs. tit. 11, § 7150
- Cal. Code Regs. tit. 11, § 7151
- Cal. Code Regs. tit. 11, § 7152
- Cal. Code Regs. tit. 11, § 7155
- Cal. Code Regs. tit. 11, § 7157
Compliance documents are what regulated businesses use to prove they follow the rules that apply to their industry, whether that is privacy, anti-money-laundering, consumer protection, or sector-specific requirements. Regulators look for consistent policies, up-to-date records, and clear evidence of employee training. The cost of getting compliance paperwork right is almost always smaller than the cost of an enforcement action, fine, or public disclosure.
Not legal advice
This template is provided for informational purposes. We recommend having an attorney review any legal document before signing, especially for high-value or complex matters.
Checked against the law it cites
A reviewer verified this template's legal citations against the official source on September 27, 2026.
Cal. Civ. Code § 1798.100 (checked September 27, 2026): "A business’ collection, use, retention, and sharing of a consumer’s personal information shall be reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed, or for another disclosed purpose that is compatible with the context in which the personal information was collected, and not further processed in a manner that is incompatible with those purposes."
Cal. Code Regs. tit. 11, § 7150 (checked September 27, 2026): "Every business whose processing of consumers’ personal information presents significant risk to consumers’ privacy as set forth in subsection (b) must conduct a risk assessment before initiating that processing."
Cal. Code Regs. tit. 11, § 7151 (checked September 27, 2026): "A business’s employees whose job duties include participating in the processing of personal information that would be subject to a risk assessment must be included in the business’s risk assessment process for that processing activity."
Cal. Code Regs. tit. 11, § 7152 (checked September 27, 2026): "A business must conduct a risk assessment to determine whether the risks to consumers’ privacy from the processing of personal information outweigh the benefits to the consumer, the business, other stakeholders, and the public from that same processing."
Draft your Data Protection Impact Assessment (DPIA) (CA) in the editor
Answer a few questions, let the AI editor draft each section from your answers, review it, and download Word and PDF. $99 one time, or $249 per month for every document and every Ezel app.