---
title: "Draft a privacy or data-protection impact assessment"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-a-privacy-or-data-protection-impact-assessment/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-T1-R6-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# Draft a privacy or data-protection impact assessment

> Build an assessment skeleton that separates a California risk assessment from a federal-agency privacy impact assessment, and list the facts still missing. Do not conclude that the processing is permitted.

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-a-privacy-or-data-protection-impact-assessment/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | Build an assessment skeleton that separates a California risk assessment from a federal-agency privacy impact assessment, and list the facts still missing. Do not conclude that the processing is permitted. |
| What the lawyer must review | The California Privacy Protection Agency states that on 24 July 2025 its Board adopted regulations, approved by the Office of Administrative Law on 22 September 2025 and effective 1 January 2026, that require certain businesses to conduct risk assessments and that give consumers rights to access and opt out of the use of automated decisionmaking technology. Open the approved regulation text before you describe what the assessment must contain or when it is due. Separately, the Justice Department's Office of Privacy and Civil Liberties states that section 208 of the E-Government Act of 2002 requires a privacy impact assessment when a federal agency develops or procures information technology that collects, maintains or disseminates information in identifiable form, or makes a substantial change to such a system. A private company is not an agency under that section. Opinion 512: do not treat a generated assessment as the lawyer's sign-off. |
| Written for | United States |
| Applies to | [Draft a privacy or data-protection impact assessment](https://ailawframework.com/practice/privacy-data-protection-and-cyber/draft-a-privacy-or-data-protection-impact-assessment.md) |

## Checking plan

- What the AI does: Build an assessment skeleton that separates a California risk assessment from a federal-agency privacy impact assessment, and list the facts still missing. Do not conclude that the processing is permitted.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- Do not copy a pre-2026 draft of the California regulations into the assessment.
- A federal privacy impact assessment and a CCPA risk assessment are different documents.

## Sources

- [California Privacy Protection Agency: CCPA updates, cybersecurity audits, risk assessments and ADMT regulations](https://cppa.ca.gov/regulations/ccpa_updates.html) (checked 2026-10-22)
- [US Department of Justice, Office of Privacy and Civil Liberties: E-Government Act of 2002](https://www.justice.gov/opcl/e-government-act-2002) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*