The Board of the California Privacy Protection Agency approved the California Privacy Rights Act (CPRA) regulations on Friday. The rulemaking package that was adopted and approved included a redline of the final regulations, a final statement of reasons, and two appendices to the final statement of reasons with responses to comments received during the 45 day and 15 day comment periods. The Board did not substantively change the drafted regulations that were released in November.
Next steps
The Board will file the final rulemaking package with the Office of Administrative Law (OAL). The OAL will have 30 business days to review these materials. The proposed regulations will not go into effect until OAL approval. The earliest the proposed regulations could be in effect is April 2023; however, that is subject to change
What this Means to You
As of January 2, 2023, the CPRA’s amendments to the California Consumer Privacy Act (CCPA) of 2018 are in effect and businesses, including eligible financial institutions, are required to comply with the statutory requirements. The CCPA regulations in effect, in addition to the CPRA statutory requirements, must also be complied with. However, civil and administrative enforcement of the provisions of law added or amended by the CPRA will not begin until July 1, 2023, and will only apply to violations occurring on or after that date. Enforcement of provisions of law contained in the CCPA amended by the CPRA will remain in effect and will be enforceable until the same provisions of the CPRA become enforceable.
For more information, visit the Board’s FAQ page.