While they would have otherwise been enforceable in about two months anyway, a California state appeals court has ruled that the California Privacy Protection Agency (CPPA) can enforce its regulations issued under the California Privacy Rights Act (CPRA) starting immediately. The decision comes on appeal from a lower court's stay of enforcement ruling that the intent of the CPRA was that businesses should have one year after the regulations were issued. Businesses that believed they had two more months to comply with the regulations should immediately get policies and procedures in place to comply. The ruling also calls into question how long businesses may have to comply with the next set of regulations yet to be issued, including around automated decision-making and cybersecurity audits or other changes to existing regulations. This ruling suggests they could be enforceable much shorter than one year after final approval.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.