This article appeared in Cybersecurity Law & Strategy, an ALM publication for privacy and security professionals, Chief Information Security Officers, Chief Information Officers, Chief Technology Officers, Corporate Counsel, Internet and Tech Practitioners, In-House Counsel. Visit the website to learn more.

In May, the California Privacy Protection Agency (CPPA or Agency) released the first draft of its much-anticipated proposed California Privacy Rights Act of 2020 (CPRA) Regulations (Regs), as well as the Agency's Initial Statement of Reasons. Although useful for the purpose of indicating what the Agency's priorities may be, the draft Regs are far from complete. Of note, the Regs purposely omit provisions on key topics, including automated decision-making and profiling, cybersecurity audits, and risk assessments; consequently, companies should expect the Regs to expand far beyond their current 66-page length.