Want to get ready for
CCPA / CPRA?
CCPA is not a framework you can select in Strac Comply yet. Here is what it asks for. And here is the part of the work you can run today, through SOC 2 and ISO 27001.
14-day free trial. No credit card.
What is CCPA / CPRA?
California Consumer Privacy Act, as amended by the CPRA (Civ. Code §1798.100 et seq.)
California Consumer Privacy Act and California Privacy Rights Act
California consumer privacy
The CCPA is California's consumer privacy law. The CPRA, which voters passed in 2020, amended it and created the California Privacy Protection Agency (CPPA). The CPPA writes the regulations and enforces them, and so does the Attorney General.
It applies to a for-profit business that does business in California and meets one test. Its gross revenue in the prior year was above the CPI-adjusted threshold, $26,625,000 today. Or it buys, sells or shares the personal information of 100,000 or more consumers or households a year, or earns 50% or more of its revenue from selling or sharing it.
Employees, job applicants and business contacts count as consumers too. New CPPA rules took effect on January 1, 2026: cybersecurity audits, risk assessments and rules for automated decisionmaking technology (ADMT).
Where Strac Comply helps with CCPA / CPRA today
Most of the CCPA is about notices and consumer rights. The costly failure is security: §1798.150 lets consumers sue after a breach of their personal information that reasonable security would have prevented.
Strac Comply already runs that security work through SOC 2 and ISO 27001. We have also mapped 67 CCPA controls to the statute and the CPPA regulations. You can't select them in the product yet.
What you can do today
These run in Strac Comply now, through the frameworks we support. CCPA / CPRA itself is on our roadmap.
Run daily tests on MFA, encryption, access and audit logs across AWS, Google Workspace, Okta and more. That is the kind of reasonable security §1798.100(e) asks for
Keep a register of every vendor with its risk score, security reviews and agreements
Log security incidents with the date you found them and the steps you took. A breach notice under §1798.82 then starts from facts
Draft your security policies with AI, then approve them. Strac Comply keeps every version with who approved it and when
Track security training for your whole team, with a completion record for each person
Where the work overlaps
CCPA / CPRA requirements, and the evidence Strac Comply can already keep for them.
- §1798.100(e)
Reasonable security
Daily MFA, encryption and access tests (SOC 2, ISO 27001)
- §1798.150(a)
Encryption of breach-action data
Encryption tests on storage, databases and backups
- §1798.82
Breach notification
Security incident log with dates
- §7051(c)
Oversight of recipients
Vendor register with risk scores and security reviews
- §7123(c)(13)
Security training
Training campaigns with a record for each person
- §7123(c)(18)
Backups and recovery
Backup tests + disaster recovery plan
Frequently asked questions
Can I run CCPA in Strac Comply today?
Not as its own framework yet. CCPA is on our roadmap.
Today you can run SOC 2 or ISO 27001. Both cover the security work the CCPA expects: MFA, encryption, access control, incident records and vendor oversight.
Strac Comply won't show a CCPA readiness score until CCPA ships.
Who has to comply with the CCPA?
A for-profit business that does business in California, decides why and how personal information is processed, and meets one of 3 tests. Its prior-year gross revenue was above $26,625,000. Or it buys, sells or shares the personal information of 100,000 or more consumers or households a year, or earns 50% or more of its revenue from selling or sharing it.
A company that controls or is controlled by such a business and shares its brand can be covered too. Service providers and contractors have duties of their own under the regulations.
What do we show a customer who asks about CCPA?
There is no CCPA certificate, and nobody can issue one. What you show is the record: your privacy policy and notices, your consumer request log, your risk assessments and the security work behind them.
If you meet the §7120(b) thresholds, you also owe an annual cybersecurity audit by a qualified, independent auditor. The auditor does the audit. Your job is to have the evidence ready.
What changed on January 1, 2026?
The CPPA's new regulations took effect. A business that meets the §7120(b) thresholds owes an annual cybersecurity audit, and its first audit report is due on April 1, 2028, 2029 or 2030, depending on its revenue.
Processing that presents significant risk to consumers needs a risk assessment before it starts. Risk assessment information goes to the CPPA each April 1, starting in 2028.
A business that uses ADMT to make significant decisions about consumers owes a pre-use notice, an opt-out or a qualifying exception, and access on request, from January 1, 2027.
Frameworks you can run in Strac Comply today
Start with what your buyers ask for.
Most teams start with SOC 2 or ISO 27001. Run either in Strac Comply today, and the security work carries over.
14-day free trial. No credit card. Plans from $4,995 per year. See pricing · Browse integrations