What Do Employers Need To Know About Risk Assessments Under The California Consumer Privacy Act? (Video) - Mondaq
California's CPRA now requires employers to conduct risk assessments for automated decision-making technology (ADMT) and sensitive data processing. This video explains the new obligations.
Aforeworn detected this change in the US State Data-Privacy Laws space on July 6, 2026 and published this briefing so affected operators are forewarned rather than caught off guard. It is rated High urgency. Employers with California employees using ADMT (e.g., hiring algorithms, performance monitoring) or processing sensitive data (e.g., health, biometrics). should confirm how it applies to their specific situation before acting. There is a time constraint attached: Risk assessments must be completed before any new ADMT or sensitive data processing begins; existing processing must be assessed by the next CPRA enforcement cycle (likely 2025).. Acting after that point can mean penalties, a lapsed licence, or lost eligibility — exactly the kind of surprise Aforeworn exists to prevent. Aforeworn monitors US State Data-Privacy Laws continuously and turns every detected change into a plain-English briefing like this one, so you always know first. Forewarned is forearmed.
What changed
CPRA risk assessment requirements now explicitly apply to employer-employee data, not just consumer data. Employers must document and assess ADMT and sensitive data processing for disproportionate impacts.
Who it affects
Employers with California employees using ADMT (e.g., hiring algorithms, performance monitoring) or processing sensitive data (e.g., health, biometrics).
What you must do
Conduct a risk assessment for any ADMT or sensitive data processing involving California employees, document the assessment, and implement mitigation measures.
Deadline
Risk assessments must be completed before any new ADMT or sensitive data processing begins; existing processing must be assessed by the next CPRA enforcement cycle (likely 2025).
Never miss a change like this again
Aforeworn watches US State Data-Privacy Laws around the clock and alerts you the moment a rule moves — with a plain-English brief on what to do.
Start your free trialRelated changes in US State Data-Privacy Laws
- Louisiana Enacts Comprehensive Consumer Privacy Law - Hunton Andrews Kurth LLP
- Social Media Privacy Laws Take Effect Tuesday: Teen Ad Ban and Portability Rights - Tech Times
- Vermont Data Privacy Bill Signed into Law - Inside Privacy
- Vermont becomes 23rd state to enact consumer privacy law - IAPP
- Vermont Becomes 23rd State with Comprehensive Consumer Privacy Law - Hunton Andrews Kurth LLP