CCR 7152 Document the risk assessment content and approval
The assessment weighs privacy risks against what the processing gains for consumers, for the business, for other stakeholders and for the public, with the aim of restricting or stopping processing whose risks outweigh its benefits (7154). The report records a specific purpose, the categories of data and the minimum needed, operational details (methods, sources, retention, consumer interaction, approximate numbers, disclosures made, recipients), for ADMT its logic and how outputs drive decisions, specific benefits, negative impacts and their causes (for example security, discrimination, loss of control, coercion, economic, physical, reputational and psychological harm), planned safeguards, whether the processing will go ahead, contributors, and the approval date with the names and roles of reviewers and approvers, including someone with authority to decide on the processing. One assessment may cover comparable activities, and one done under another law may be reused if supplemented (7156).
Source: CCPA/CPRA, CCR 7152. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open CCPA/CPRA in the compliance library.
Applies only to a business that meets one of the thresholds in Cal. Civ. Code 1798.140(d).
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Risk assessment report template containing each 7152(a) element · Policy repository / GRC workspace
- Completed reports with approval signatures and dates · Policy repository / GRC workspace
- Safeguard implementation evidence linked to identified negative impacts · Policy repository / GRC workspace
governing documentDocuments that govern the control
- Mapping showing how assessments done for other state laws were supplemented · Policy repository / GRC workspace
First move
Common gaps auditors find
- Purposes described generically, such as to improve our services
- No decision recorded on whether processing proceeds
- Approver lacks authority over the processing decision
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCCR 7151 Involve the people who run the processing · CCR 7153 Give ADMT customers the facts they need for their own assessment