Compliance activities loom large as organizations gear up for the California Privacy Rights Act to take force next year. Remaining measures depend largely on the substance of the California Privacy Protection Agency’s much-anticipated CPRA rulemaking.

The CPRA provides for regulations to be finalized by July 1 to allow for a six-month compliance window ahead of the law’s Jan. 1, 2023 effective date, but a surprise announcement from the CPPA suggests a compliance scramble is on the horizon. While offering a rulemaking update at a recent board meeting, CPPA Executive Director Ashkan Soltani indicated completion of the rulemaking process will go beyond the July target date.

“The agency’s rulemaking authority takes effect in April. When we have information gathered through preliminary work, we can expect formal proceedings for a formal rulemaking package in Q2,” Soltani said during the public meeting. “Formal proceedings, including public hearings, will continue into Q3 with rulemaking being completed in Q3 or Q4. While this puts us somewhat past the July 1 rulemaking schedule in the statute, it allows us to balance staffing of the agency while undertaking substantial information gathering to support our rules.”