CALIFORNIA REGULATORS FINALIZE CYBERSECURITY AUDIT REQUIREMENTS
November 17, 2025
Eckert Seamans has prepared the information in this update for educational purposes only. It does not constitute legal advice nor substitute for legal advice. Neither your receipt of information from this website nor your use of this website to contact Eckert Seamans or one of its attorneys creates an attorney-client relationship, as the firm may, for example, already represent another party involved in your matter. Accordingly, you should not provide confidential information to Eckert Seamans. Persons seeking legal advice should consult a licensed professional attorney in their state. The firm’s Terms of Use, Legal Notice, and Disclaimer detailed herein are expressly incorporated into the Aviation Regulatory Update.
California’s Privacy Protection Board recently finalized rules governing annual cybersecurity audit requirements for “high risk” processing activities, which include processing of sensitive personal information, processing personal data for targeted advertising purposes, or using automated decision-making tools (such as artificial intelligence models) to process personal information. The cybersecurity audit requirements are extensive and require companies to submit annual certifications of compliance to the California Board. Companies will need to ensure that they comply with these requirements by April 1, 2028 – 2030 (the due date varies depending on the company’s annual revenue). Our Cybersecurity, Data Protection, and Privacy team can assist in this regard should carriers seek advice on data protection best practices, privacy or cybersecurity training, and incident response planning.
Airlines seeking to mitigate such cyber risks should take the following actions: (i) audit their security program and secure adequate support and resources to promptly address any identified gaps; (ii) revisit their third party vendor agreements to impose robust cybersecurity procedures and mechanism on such vendors, including regular staff social engineering awareness training; (iii) develop a third party risk management program to adequately assess and monitor its vendor’s security practices; and (iv) ensure that their own staff are regularly trained to detect and respond to social engineering attacks. Any airline suffering a data breach should immediately engage expert breach response counsel to assist with breach response and should continuously monitor new cybersecurity requirements that may affect their cybersecurity program.
This Aviation Blog Post is intended to keep readers current on developments in the law. It is not intended to be legal advice. If you have any questions, please contact Evelyn Sahr at 202.659.6622 or esahr@eckertseamans.com; Drew Derco at 202.659.6665 or dderco@eckertseamans.com; Samantha Walter at 412.566.1920 or swalter@eckertseamans.com, Tyler Myers at 202.659.6642 or trmyers@eckertseamans.com, or any other attorney at Eckert Seamans with whom you have been working.
Share This Post
Authors
