Governance, risk & compliance
California state privacy and sector law (CalOPPA, breach, CMIA, DMV) Read 23 Oct 2026; see source list
California state law that applies alongside the CCPA and the federal sector rules, organized by tier so an organization picks only the sectors it works in.
Privacy (all organizations): the online privacy policy law (CalOPPA, Bus. & Prof.
Code ss. 22575-22579), reasonable security and breach notification (Civ.
Code ss. 1798.
81. 5 and 1798.
82), data brokers and the Delete Act deletion platform (Civ. Code s.
1798. 99.
80 et seq. ), and how existing California law applies to AI tools.
Insurance: the Insurance Information and Privacy Protection Act (Ins. Code s.
791 et seq. ) and 10 CCR ss.
2689. 1-2689.
24. Finance: the Financial Information Privacy Act (Fin.
Code ss. 4050-4060) and DFPI incident guidance.
Health: the Confidentiality of Medical Information Act (Civ. Code s.
56 et seq. ), the Patient Access to Health Records Act, and the state health breach and data-exchange rules.
Transportation: DMV record release limits (Veh. Code ss.
1808. 21-1808.
23 and others) and automated license plate recognition (Civ. Code s.
1798. 90.
5 et seq. ).
Public sector: the Public Records Act (Gov. Code ss.
7920. 000-7930.
215), the Information Practices Act, state security policy, and the state rules for federal pass-through programs (Medi-Cal, CalFresh and other benefits, unemployment insurance) and criminal justice data (CLETS). It does not repeat the CCPA, which is its own framework, or the CPPA regulations, which are CA_CPPA_REGS.
Federal law (HIPAA, GLBA, CJIS, IRS 1075) is in its own frameworks; this one adds only what California adds. Not confirmed from a primary source and so not asserted: whether California has adopted the NAIC Insurance Data Security Model Law (#668); the chaptered text and operative date of SB 446 (a fixed 30-calendar-day breach notice deadline); the operative dates of the 2026 AI bills.
Each is said so where it appears. General information for compliance work, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses California state privacy and sector law (CalOPPA, breach, CMIA, DMV) at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| Privacy (all) | California law that applies to nearly every organization with California residents as customers, users or staff: the online privacy policy law, reasonable security and breach notification, data brokers and the Delete Act platform, and existing California law applied to AI tools. | — |
| Insurance | Insurers, agents and insurance support organizations licensed by the California Department of Insurance: the Insurance Information and Privacy Protection Act (Ins. Code s. 791 et seq.) and 10 CCR ss. 2689.1-2689.24, including the written information security program in Article 4. | — |
| Finance | Banks, lenders, brokers and other financial institutions: the California Financial Information Privacy Act (Fin. Code ss. 4050-4060) and the Department of Financial Protection and Innovation (DFPI) incident reporting guidance. Federal GLBA is in its own framework. | — |
| Health | Providers, plans and their vendors handling California medical information: the Confidentiality of Medical Information Act (Civ. Code s. 56 et seq.), the Patient Access to Health Records Act, state breach reporting to the Department of Public Health, and the state data-exchange framework. HIPAA is in its own framework. | — |
| Transportation | Organizations that use DMV driver and vehicle records, run fleets or vehicle services, or operate automated license plate readers: Vehicle Code limits on releasing DMV information and Civil Code s. 1798.90.5 et seq. on ALPR data. | — |
| Public sector | State and local agencies and their contractors: the Public Records Act, the Information Practices Act, state security policy, the Medi-Cal, CalFresh and other benefit, and unemployment insurance data rules that the state adds to federal law, and CLETS rules for criminal justice data. | — |
How Lavawall® helps you get to California state privacy and sector law (CalOPPA, breach, CMIA, DMV) compliance
Most of California state privacy and sector law (CalOPPA, breach, CMIA, DMV) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to California state privacy and sector law (CalOPPA, breach, CMIA, DMV), and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against California state privacy and sector law (CalOPPA, breach, CMIA, DMV) in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports California state privacy and sector law (CalOPPA, breach, CMIA, DMV) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- California state privacy and sector law (CalOPPA, breach, CMIA, DMV) Read 23 Oct 2026; see source list
- Category
- Privacy
- Region
- USA - California
- Levels
- 6 assessment tiers
All California, United States frameworks and training →
Map this framework freeTalk to our team