September 27, 2026
CIIPPA signed into law.
CIIPPA Readiness
Get your insurance agency ready for California's new privacy law.
ACC Inc. helps California insurance agencies and brokers prepare for CIIPPA. We find where your customers' information lives, put safeguards in place, and build the records and breach response the law expects, working alongside your attorney.
What CIIPPA means for your agency
The California Insurance Information and Privacy Protection Act (CIIPPA) was signed in September 2026. It replaces California's older insurance privacy law and takes effect on July 1, 2028.
It applies to businesses licensed by the California Department of Insurance, and to the vendors that handle their customers' information. It covers the information you collect from applicants, policyholders, claimants, and beneficiaries.
Your attorney can tell you exactly how the law applies to your agency. We help you get the systems and day-to-day practices ready.
Key dates
July 1, 2028
CIIPPA takes effect.
By January 1, 2029
The Insurance Commissioner is required to issue regulations with more detail.
Two years sounds like a lot of time. For a small agency with day-to-day work to do, it goes fast. Starting early means fewer surprises and less rush.
Readiness and legal advice: who does what
ACC Inc.: systems and safeguards
We handle the technical and day-to-day side: finding where customer information is stored, securing your systems, setting up retention and deletion, preparing your breach response, reviewing vendors, and keeping records of the work.
Your attorney: legal advice
Your attorney handles the legal side: privacy notices, consent and opt-out wording, contract language, and how the law and upcoming regulations apply to your agency.
What CIIPPA readiness covers
Know where your data lives
Find where customer information is collected, stored, and shared, including your agency management system, email, carrier portals, and shared files.
Keep only what you need
Set up a written retention schedule, and a way to securely delete information you no longer need.
Protect your systems
Put safeguards on the computers, accounts, networks, and remote connections that handle customer information.
Handle customer requests
Set up a simple process to find, correct, or delete a customer's information when they ask.
Review your vendors
Know which vendors have access to customer information, and make sure they protect it and report security incidents.
Respond to a breach
Have a plan for what to do if information is exposed, including reporting to the insurer and the Insurance Commissioner, generally within 30 days.
How we prepare your agency for CIIPPA
1
Understand your agency
We learn how you collect, use, and share customer information, which systems support that work, and who has access.
2
Find the gaps
We compare your current safeguards and practices against what the law expects, then agree on what to address first.
3
Put safeguards in place
We implement security protections, set up retention and breach response, and document the work so you can show what you have in place.
4
Keep it current
We help you update your safeguards and records as your agency changes and as the Insurance Commissioner issues new regulations.
Is your agency ready for 2028?
Whether you're just hearing about CIIPPA or already working with your attorney, we'll help you understand where you stand and what to do next.