CCR 7155 Review risk assessments every three years and after material change
A risk assessment must be completed and documented before the processing begins, reviewed at least every three years, and updated as soon as feasible and within 45 calendar days of a material change, meaning one that creates new negative impacts, makes existing ones larger or likelier, or weakens safeguards. Assessments for processing begun before 1 January 2026 that continues afterwards are due by 31 December 2027. Assessments, original and updated, are kept while the processing runs and for five years after completion if that is later.
Source: CCPA/CPRA, CCR 7155. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open CCPA/CPRA in the compliance library.
Applies only to a business that meets one of the thresholds in Cal. Civ. Code 1798.140(d).
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Retention rule for assessment versions · Data governance / DLP tooling
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Assessment register with completion, review and next-review dates · Policy repository / GRC workspace
- Change management trigger that flags material changes for reassessment within 45 days · Policy repository / GRC workspace
First move
Common gaps auditors find
- Assessments never revisited after launch
- Material changes such as new data sources not routed back to the assessment
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCCR 7153 Give ADMT customers the facts they need for their own assessment · CCR 7157 Submit risk assessment information and attestation to the CPPA