I think there are two considerations for that. One is there is industry standards that can be referenced and leveraged. There's a specific opportunity for that within the CPPA. Then there's the opportunity as well for the Office of the Privacy Commissioner to issue guidance.
On April 15th, 2024. See this statement in context.