California Just Turned Privacy Compliance Into a Sworn Statement. Who's Actually Qualified to Draft It?
November 10, 2026
Ric Hall, CRO— AI-assisted and reviewed prior to publication.
Starting in 2028, a named executive at thousands of California-facing businesses will sign an annual filing to the state's privacy regulator under penalty of perjury, attesting that a cybersecurity audit and privacy risk assessments were actually completed. The signature carries personal legal exposure. The real question for any company is who did the work the executive is vouching for, and whether that person actually understood it.
What does California's new CCPA certification requirement actually say?
The California Privacy Protection Agency finalized a sweeping package of amended CCPA regulations covering cybersecurity audits, privacy risk assessments, and automated decision-making technology. The California Office of Administrative Law approved the rules on September 23, 2025, with the regulations taking effect January 1, 2026 and compliance deadlines phased in through 2030 based on company revenue.
The mechanism that makes this different from most privacy rules is the attestation itself. Qualifying businesses must submit a written certification to the CPPA confirming the cybersecurity audit was completed, and that filing must be signed under penalty of perjury by appropriate executive leadership. Risk assessment reporting works the same way: starting April 1, 2028, businesses must submit an executive attestation, under penalty of perjury, that the assessments were completed. An attorney writing for GT Law put it plainly: by signing, the executive is making a sworn statement under penalty of perjury, meaning they can be held legally liable if the statement is false or misleading.
The agency is also staffing up to check the work. In February 2026, the CPPA appointed its first Chief Privacy Auditor and formally created a new Audits Division with authority to audit businesses, service providers, and contractors directly where processing presents significant risk.
Who should be signing, and who should be doing the work underneath it
Law firms advising clients on this rule are not telling companies to simply pick a title and have them sign. The guidance from Alston & Bird is to designate responsible executives and ensure they have sufficient knowledge to do so accurately before the first audit period closes. That phrase, sufficient knowledge, is the whole problem. An executive signing a perjury attestation based on a summary memo from a team that never ran a real gap analysis against the regulation's required audit components is not protected by good intentions.
This is where staff accountability becomes a procurement question rather than an HR one. A company preparing for its first CPPA certification needs someone inside the privacy or GRC function who can actually build a record that would survive the CPPA's own audit, not just a slide deck for the executive to sign off on. That means someone fluent in data protection impact assessments, records of processing activity, and the specific documentation trail regulators have already shown they will test.
The pattern is visible in enforcement actions that predate this rule. California regulators reached a $1.55 million settlement with a health media company after finding deficiencies in contracts with third-party vendors alongside opt-out failures, and a separate action resulted in a $1.35 million settlement, the largest CCPA penalty to date, after the company failed to amend or enter into third-party data protection vendor contracts by regulatory deadlines. In a third case, California's privacy agency made clear that reliance on vendor tools does not absolve a business of responsibility for a broken opt-out mechanism. None of those cases involved a sworn perjury filing. The new audit and risk assessment certification raises the stakes on exactly the kind of documentation gaps regulators were already fining companies over.
Why this changes the calculus on who you hire or train
A privacy program that can produce defensible evidence does not happen because an executive wants to sign something true. It happens because the people building the record understand what a regulator actually checks: deletion certifications in vendor contracts, documented risk assessments for high-risk processing, and a data map that matches what the business actually does rather than what the privacy policy says it does. The CPPA's cybersecurity audit requirements list eighteen specific control areas, and the documentation burden around them, including five-year record retention, is explicit enough that a generalist compliance hire will not keep up without structured training.
This is also showing up in hiring signals well before the first certification deadline. Listings for privacy program and compliance roles increasingly name specific IAPP credentials by title. Postings reviewed on major job boards call for CIPP, CIPM, or CIPT certification as a preferred or required qualification for privacy analyst, data protection officer, and compliance manager roles, and one tracker puts the Certified Information Privacy Manager credential at 549 active US job postings with a salary floor around $140,000. That is a market signaling that it wants people who can build the underlying record, not just interpret the law in the abstract.
For a company facing its first CPPA filing, the practical sequence looks like this:
- Identify who inside the organization actually owns the data inventory, the vendor contract language, and the risk assessment documentation, separate from whoever will ultimately sign.
- Confirm that person has formal training in privacy program management, not just general security awareness, since the CPPA's audit components and risk assessment rules are privacy-specific, not generic infosec controls.
- Build the evidence trail now. The audit period for the largest businesses already began, and waiting until the certification deadline to assemble records means the underlying operating year is already locked in.
The Forge University CIPM certification prep course is built around exactly this gap: running a privacy program that produces audit-ready documentation, not just passing a law school style exam on what the statutes say. If your team is going to be the one building the file an executive signs under penalty of perjury, that distinction matters more than it used to.
What this means for procurement and the executive sign-off itself
Boards and general counsel offices evaluating whether to bring this work in-house or lean on outside counsel should treat the certification credential the same way they treat any other staff accountability control: as evidence a qualified person did the work, not as a formality. A documented program run by CIPP or CIPM certified staff gives the signing executive something concrete to point to if the CPPA's Audits Division ever asks how the certification was prepared. A program built on ad hoc spreadsheets and a law firm memo gives them nothing but their own signature.
That is a reasonable standard for any regulated function, and it is becoming the standard here specifically because the rule created personal liability where none existed before. Executives who would never sign a financial statement without an audit trail behind it should not sign a cybersecurity or risk assessment attestation on a weaker basis just because the subject is data privacy instead of accounting.
If your organization is still deciding who owns this work, the Forge University resources hub walks through how the CIPM curriculum maps to the documentation a program like this actually needs, from data inventories to vendor contract review to incident response records. Getting ahead of the April 2028 deadlines, rather than scrambling the quarter before, is the difference between a defensible filing and a rushed one. If you want a study plan built around this, you can start training whenever you're ready.
The broader state privacy landscape makes this more than a California problem. More than twenty states now have comprehensive privacy laws with their own processor contract requirements, and Connecticut has already shown it will fine companies for privacy notices and opt-out mechanisms that do not match what the law actually requires. The specific perjury mechanism is California's, but the underlying expectation, that someone on staff can document compliance well enough for an executive to stand behind it, is becoming standard across every state with a comprehensive privacy statute on the books.