The enforcement of the new California Privacy Rights Act (CPRA) rules has been put on hold – for now.

In a last-minute decision on June 30, a Sacramento County Superior Court decision postponed the enforcement of CPRA regulations from July 1, 2023, to March 29, 2024. This decision came after the California Chamber of Commerce filed a complaint arguing that businesses needed more time to adapt to the rules. The Court emphasized the need for a reasonable break between finalizing rules and enforcing them. The California Privacy Protection Agency (CPPA), which oversees these rules, previously acknowledged earlier in the year that they would not meet the July 1, 2022, deadline due to staff and resource shortages.

The delay only applies to the new CPRA rules, not the body of the CPRA statute or regulations previously finalized. Additionally, both the California Privacy Protection Agency and the California Department of Justice can still bring enforcement actions on CPRA amendments as of July 1, 2023.

This delay gives businesses extra time to get used to new CPRA rules about things like data processing agreements, how customers can opt-out, and how to handle customer requests, among others – and therefore represents a good opportunity for businesses to make sure they prepared when enforcement begins in 2024.