CCPA for Employee Data

How the law came to cover HR data

The CCPA took effect in 2020 but temporarily exempted most employee and applicant data, requiring only a notice at collection. The CPRA, approved by California voters in 2020, extended that exemption to January 1, 2023, and it then expired. From that date, California applicants, employees, contractors, and in many cases their emergency contacts and dependents have full rights under the law. California remains the only US state whose comprehensive privacy law applies fully to HR data; most other state privacy laws exclude data collected in an employment context.

Who is covered

The law applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenue above $25 million (adjusted periodically for inflation), buying, selling or sharing the personal information of 100,000 or more California consumers or households, or deriving at least half of annual revenue from selling or sharing personal information. Most mid-size and large employers with even a handful of California staff or applicants meet the revenue test. Location of the headquarters does not matter; the residency of the person does.

What employers must do

• Notice at collection: before or when collecting data, tell applicants and employees what categories of personal information you collect, why, whether it is sold or shared, and how long you keep each category. Recruiting teams usually put an applicant version on the careers site and in the application flow.
• Privacy policy: a full policy describing HR data practices and how to exercise rights.
• Honor rights requests: the right to know and access, delete, correct, opt out of sale or sharing, and limit use of sensitive personal information. Employers typically have 45 days to respond, extendable once by another 45 days with notice.
• Sensitive personal information: Social Security numbers, account log-ins, precise geolocation, racial or ethnic origin, union membership, health data and biometrics need extra care and, in some uses, a right to limit.
• Contracts with vendors: ATS, background check, payroll and assessment providers must be bound by service provider terms.
• No retaliation against people who use their rights.

Rights are not absolute. An employer can decline to delete records it must keep under employment law or needs to defend legal claims. A former employee's request to delete their personnel file, for example, is mostly declined, with an explanation. That interacts directly with your candidate data retention schedule.

Worked example: an employee access request

Maria Lopez, a former call center agent in Fresno, emails HR asking for all data the company holds about her. HR verifies her identity, then gathers data from the HRIS, payroll, the timekeeping system, the quality monitoring platform (call recordings and scores), the ATS (her original application and interview notes) and IT (badge logs and email metadata). Within 45 days it sends a copy in a usable format, withholding information that would reveal another person's personal information or privileged legal material. For a process view of handling these, see data subject access requests.

The hardest part in practice is not the law but finding the data. Employers that have never mapped where HR data lives usually miss the request deadline the first time.

Automated decisionmaking rules

In 2025 the California Privacy Protection Agency finalized regulations on automated decisionmaking technology (ADMT), risk assessments and cybersecurity audits. Employment decisions such as hiring, allocation of work, pay, promotion and termination count as significant decisions. Businesses that use ADMT for those decisions must give a pre-use notice, honor opt-out or provide a human appeal under the regulation's conditions, and respond to access requests about the logic and outcome, with these ADMT obligations phasing in from January 1, 2027. This sits alongside separate California Civil Rights Council rules on automated decision systems under anti-discrimination law.

How it differs from GDPR

The two overlap but are not interchangeable. GDPR in recruitment requires a lawful basis for every processing activity; the CCPA does not, but focuses on notice, consumer rights and limits on selling and sharing. GDPR applies based on where processing happens and who is targeted; the CCPA applies to California residents of covered businesses. A program built for GDPR covers much of the CCPA, but the notice wording, response timelines and sensitive data rules differ.

Common mistakes

• Assuming the employee exemption still applies.
• No notice at the point applicants actually submit data.
• Forgetting contractors, interns and dependents.
• Vendor contracts with no service provider terms.
• Treating the response as an IT task without HR and legal review.

This is general information, not legal advice; enforcement is by the California Privacy Protection Agency and the Attorney General.