The Complete CPRA Requirements Checklist: 47 Controls Your Organization Needs in Place
Most organizations think they are CPRA-compliant. Our checklist reveals the requirements that get missed, especially for multi-entity businesses managing privacy across subsidiaries and jurisdictions.
Why a CPRA Requirements Checklist Matters More Than You Think
The CPRA didn't just tweak the CCPA. It redefined California privacy enforcement, and organizations that assumed their old compliance posture carried over are now exposed.
Enforcement Is Proactive Now
The CPPA Is No Longer Waiting for Complaints
The California Privacy Protection Agency has shifted from reactive complaint handling to proactive audits and joint enforcement sweeps. In September 2025, California, Colorado, and Connecticut launched a joint investigation targeting businesses failing to honor Global Privacy Control signals.
The CPPA reported hundreds of active investigations at its September 2025 board meeting, many targeting businesses that don't yet know they're under scrutiny. New regulations covering cybersecurity audits, risk assessments, and automated decision-making took effect January 1, 2026.
$1.35M
Largest CPPA fine to date, against Tractor Supply Company (September 2025)
The Penalty Math
Per-Violation Fines Compound Fast
As of 2025, the CPPA adjusted civil penalties to $2,663 per unintentional violation and $7,988 per intentional violation or violation involving minors. These amounts are calculated per consumer, per incident, which means a single systematic gap across your California consumer base can escalate into seven or eight figures of theoretical exposure.
The CPRA also eliminated the mandatory 30-day cure period that previously existed under the CCPA. Whether a business gets time to fix a violation is now entirely at the enforcer's discretion.
$7,988
Maximum per intentional violation (CPI-adjusted as of January 2025, per CPPA announcement)
Multi-Entity Complexity
Subsidiaries Multiply Your Risk Surface
If your organization operates across subsidiaries, business units, or jurisdictions, each entity may have its own data processing activities, vendor relationships, and consumer touchpoints. The CCPA applies to entities controlled by covered businesses as well as joint ventures and partnerships, meaning a parent-level checklist applied once is not sufficient.
Enforcement is also going cross-border. Multi-state joint investigations mean companies operating across multiple states can no longer assume enforcement stays siloed within individual jurisdictions. Each entity needs independent verification of compliance.
3 states
California, Colorado, and Connecticut launched joint enforcement sweeps in September 2025
Privacy teams are stretched thin. Most organizations don't have dedicated CPRA specialists. The DPO or privacy lead is juggling GDPR, a growing patchwork of US state laws, and sector-specific regulations all at once.
That's exactly why we built this checklist: to give privacy teams a single, structured document that maps every CPRA requirement to a concrete action.
Proven Customer Results
The numbers behind group-wide privacy compliance done right
200+
Hours saved on ISO 27001 preparation
Medtec used Priverion to cut through the documentation and evidence-gathering burden that typically takes organizations 6 to 12 months to complete manually.
Medtec, ISO 27001 preparation
60%
Reduction in compliance admin time
Aircraft manufacturer eliminated manual ROPA updates across multiple subsidiaries in their first 6 months, while enterprise privacy platforms like OneTrust can cost up to six figures annually for mid-market deployments.
Aircraft manufacturer, first 6 months with Priverion
100%
ROPA recertification rate, fully automated
AXA achieved complete automated recertification across all processing activities, replacing the manual spreadsheet workflows that GDPR Article 30 demands be accurate and current at all times.
AXA, automated ROPA recertification
Why mid-market teams are switching from OneTrust
OneTrust is a powerful enterprise platform. But for mid-market organizations managing privacy across multiple entities, it often means paying for complexity you never use. Here is how Priverion compares where it matters most.
Priverion
Swiss data sovereignty, guaranteed
Swiss-built and Swiss-hosted. All data processing stays within Swiss infrastructure, protected from extraterritorial access laws like the US CLOUD Act and FISA Section 702. In a post-Schrems II world, this is not a marketing checkbox.
Operational in weeks, not months
Priverion is purpose-built for multi-entity privacy management. No weeks of workflow configuration, no dedicated implementation team required. Aircraft manufacturer was fully operational and saw a 60% reduction in compliance admin time within six months.
Aircraft manufacturer, first 6 months
Predictable, transparent pricing
Pricing based on number of companies and organizational size. No per-user fees, no per-module expansion traps. You know what you will pay this year and next year.
All-in-one for privacy programs
ROPA management, DPIA/TIA automation, vendor risk assessments, incident management, DSR handling, cross-entity data mapping, and board-ready dashboards. One platform, one price. No module upsells.
AI-assisted, human-controlled
AI helps draft DPIAs and score risks, but every output is reviewed before becoming a compliance record. No customer data is used for model training. AI assists, humans decide.
Typical enterprise platform
US-headquartered, US-jurisdictioned
Even when data is stored in EU data centers, US-headquartered providers remain subject to the CLOUD Act. As the general manager of Microsoft France testified before the French Senate in 2025, US providers cannot guarantee EU citizen data is safe from access by US authorities.
Source: French Senate testimony, 2025
Complex setup, steep learning curve
Reviewers consistently note weeks of configuration time and significant training requirements. One mid-market user on G2 reported the interface "can feel cluttered" and noted "the high price and the steep learning curve" as drawbacks. Implementation services can add $10,000 to $50,000 in first-year costs alone.
G2 and Capterra user reviews, 2025; Enzuzo pricing analysis, March 2026
Opaque, modular pricing that escalates
No public pricing. Each module billed on its own metric. Mid-market organizations (1,000 to 5,000 employees) can expect $40,000 to $120,000 per year, with pricing that "can balloon once you add the modules you actually need." OneTrust does not publish list prices; buyers should request a multi-year quote covering all modules and seats up front.
Vendr pricing data, February 2026; Enzuzo, March 2026
Feature overload across 5+ product lines
Enterprise platforms offer ESG, ethics hotlines, cookie consent, and 200+ integrations. If you need all of that, they are the right choice. But most mid-market privacy teams end up paying for capabilities they never touch.
AI capabilities with less transparency
Large platform vendors offer AI features, but it is often unclear where data is processed, whether it is used for training, and how much human oversight remains in the loop. For compliance records, that opacity creates risk.
We are honest about what we do not cover: ESG, ethics hotlines, and cookie consent are outside our scope. Our strength is group-wide privacy program management for organizations with multiple entities and jurisdictions.
If that is the problem you are solving, let's talk.
Book a 30-min walkthroughCPRA Requirements Checklist: 2026 Compliance in One Document
New CPPA regulations took effect January 1, 2026, introducing mandatory risk assessments, cybersecurity audit timelines, and ADMT obligations. This checklist covers what your compliance team needs to verify right now.
Inside the checklist, you will find:
- + Complete applicability criteria: revenue thresholds, consumer volume, and sensitive data processing triggers that determine whether CPRA applies to your organization
- + Data mapping, DSAR workflow, and vendor contract requirements, including the 5-day service provider notification clause and updated SPI limitation mechanisms
- + Phased cybersecurity audit deadlines by revenue tier (April 2028 for businesses over $100M, through April 2030 for smaller organizations) and risk assessment submission timelines
- + Penalty reference guide with current fine amounts (up to $7,988 per intentional violation) so you can communicate risk to leadership in financial terms
The CPPA finalized these regulations in September 2025 and has reported hundreds of active investigations, including the record $1.35 million settlement with Tractor Supply Company. Enforcement is not hypothetical.
Sources: CPPA enforcement records (September 2025), CPPA finalized regulations (January 2026).
Get the Checklist
Covers all 2026 CPRA obligations in a single, actionable PDF.
Free PDF. No demo required. We'll send it to your inbox.
Why this matters now
The CPPA removed the 30-day cure period. There is no warning letter before fines begin. Organizations managing California consumer data across multiple entities need documented compliance, not a plan to start later.
Frequently Asked Questions About CPRA Compliance
What is the difference between the CCPA and the CPRA?
The CPRA (California Privacy Rights Act) significantly amended and expanded the CCPA. Key changes include the creation of the California Privacy Protection Agency (CPPA) as a dedicated enforcement body, new categories of sensitive personal information with specific consumer rights, mandatory risk assessments for high-risk processing, rights to correct and limit use of sensitive data, and the elimination of the 30-day cure period for violations. The CPRA took effect on January 1, 2023, and applies to data collected on or after January 1, 2022.
Who does the CPRA apply to?
The CPRA applies to for-profit businesses that collect California consumers' personal information and meet at least one of three thresholds: annual gross revenue over $25 million in the preceding calendar year, buying, selling, or sharing the personal information of 100,000 or more consumers or households annually, or deriving 50% or more of annual revenue from selling or sharing personal information. Importantly, the CPRA also applies to entities controlled by covered businesses, including subsidiaries and joint ventures, which is why multi-entity organizations face particularly complex compliance requirements.
What are the penalties for CPRA non-compliance?
As of January 2025 (CPI-adjusted), penalties are $2,663 per unintentional violation and $7,988 per intentional violation or violations involving minors. These are calculated per consumer, per incident, with no total cap. The largest CPPA fine to date was $1.35 million against Tractor Supply Company in September 2025. The CPRA also preserves the private right of action for data breaches resulting from failure to implement reasonable security measures, where consumers can recover between $100 and $750 per incident, or actual damages, whichever is greater.
What new CPRA regulations took effect in 2026?
Regulations finalized by the CPPA in September 2025 took effect January 1, 2026. These cover three major areas: mandatory cybersecurity audits (phased by revenue tier, with businesses over $100M in revenue required to complete their first audit by April 2028, and smaller organizations by April 2030), risk assessments for processing activities that present significant risk to consumers' privacy, and automated decision-making technology (ADMT) obligations including consumer opt-out rights and pre-use notices for profiling and significant decisions.
How does Priverion help with CPRA compliance for multi-entity organizations?
Priverion provides group-wide privacy program management across all subsidiaries and entities from a single platform. For CPRA compliance specifically, this includes automated ROPA management and recertification across entities (Aircraft manufacturer reduced compliance admin time by 60% in their first 6 months), AI-assisted DPIA and risk assessment drafting to meet the new 2026 requirements, vendor risk assessments and third-party contract management, incident management and breach notification workflows, DSR handling across entities, and cross-entity data mapping for group-wide visibility. All data is processed within Swiss infrastructure with full data sovereignty guarantees.
Does the CPRA apply to companies outside California?
Yes. The CPRA applies to any for-profit business that meets the revenue or data processing thresholds and collects personal information from California consumers, regardless of where the business is headquartered. This includes European and international companies doing business with California residents. For multi-entity organizations, each subsidiary with California consumer touchpoints may need independent compliance verification. The September 2025 joint enforcement sweep between California, Colorado, and Connecticut further demonstrated that state privacy enforcement is increasingly coordinated across jurisdictions.
What does this checklist cover that generic CPRA guides do not?
Our checklist maps all 47 specific control requirements with actionable verification steps, including the 2026 regulations that most existing guides haven't incorporated. It covers phased cybersecurity audit deadlines by revenue tier, the new ADMT obligations, updated risk assessment requirements, and the specific service provider contract clauses (including the 5-day notification requirement) that multi-entity organizations need to verify across every vendor relationship in every subsidiary. Each control includes the relevant regulatory citation so your legal team can verify independently.
Your compliance posture can't wait
Stop managing privacy compliance across spreadsheets. Start sleeping through the night.
GDPR fines hit €1.2 billion in 2025 alone, with European authorities now processing over 400 breach notifications per day. For multi-entity organizations, the margin for error has never been thinner. In 30 minutes, we'll show you how Priverion replaces fragmented tools and manual processes with automated, group-wide privacy program management.
60%
less compliance admin time
Aircraft manufacturer, first 6 months
200+
hours saved on ISO 27001 prep
Medtec
100%
ROPA recertification rate
AXA, fully automated
Swiss-built. Swiss-hosted. AI-assisted with full human oversight. No customer data used for model training. Predictable pricing without per-user traps.
No commitment required. See real customer workflows in a live environment.
The Privacy Compliance Briefing
Monthly insights on GDPR enforcement, Swiss FADP updates, and automation strategies for DPOs and compliance teams.
No spam. Unsubscribe anytime.
