CCPA Employee Data: Coverage, Employer Duties, and Penalties

California’s CCPA now covers employee data in full. The temporary exemption that had kept applicants, employees, and independent contractors outside most of the law expired on January 1, 2023, and workers at covered employers hold the same privacy rights as any other California consumer.¹ For employers, that means notices before collection, honoring access and deletion requests, limiting what gets gathered in the first place, and real financial exposure when any of it goes wrong.

Which Employers Are Covered

The CCPA reaches for-profit businesses that do business in California and hit at least one of three thresholds:²

Annual gross revenue above $25 million in the prior calendar year, with the figure adjusted annually for inflation.
Buying, selling, or sharing the personal information of 100,000 or more consumers or households each year.
Deriving 50 percent or more of annual revenue from selling or sharing personal information.

A parent, subsidiary, or affiliate that shares common branding and personal information with a covered business is pulled in too, even if that entity would not meet a threshold on its own. Nonprofits and government agencies sit outside the CCPA’s scope.

What Employee Information the Law Covers

Personal information under the CCPA is defined broadly: anything that identifies, relates to, or could reasonably be linked to a specific person.¹ In a workplace, that stretches well past the personnel file. Social Security numbers, driver’s license numbers, home addresses, salary figures, performance reviews, and educational history all qualify. So do the digital traces employees leave behind: browsing on a company laptop, interactions logged by internal software, access records.

A narrower subcategory called sensitive personal information carries stronger protections. In the employment context it includes:³

Racial or ethnic origin, religious beliefs, and union membership.
Health information and sexual orientation.
Precise geolocation, including data pulled from company vehicles or mobile devices.
Biometric identifiers such as fingerprints or facial recognition used for building access.

Employers collect this kind of data routinely through background checks, benefits enrollment, wellness programs, and workplace monitoring. If a data point can be traced back to a particular worker, assume it is covered.

Rights Employees, Applicants, and Contractors Now Hold

The rights apply to all personal information the employer holds, not just data gathered after the exemption expired.

Know and access. A worker can ask the employer to disclose the specific pieces of personal information it has collected, and the employer must deliver that data in a portable, readily usable format.⁴
Correct. When records contain factual errors, the employee can direct the employer to fix them, and the employer must use commercially reasonable efforts to do so.⁵
Delete. Employees can request deletion of personal information the employer collected from them. The right is not absolute at work. Employers may keep what they need to meet a legal obligation or finish an ongoing business transaction, which covers tax records, payroll data, and documentation required by labor law.⁶
Limit use of sensitive information. A worker can tell the employer to use sensitive personal information only for purposes necessary to perform the services the employee reasonably expects. Health data, biometrics, and precise location can all be restricted this way.⁷
Opt out of sale or sharing. If the employer sells or shares employee information with third parties, the employee can direct the employer to stop, and that direction holds unless the employee later gives fresh consent.⁸

Retaliation for exercising any of these rights is prohibited. An employer cannot demote, terminate, cut pay, or otherwise discriminate against a worker who submits a privacy request.¹

To make these rights usable, the employer must offer at least two ways to submit a request, one of which is a toll-free phone number. The employer has 45 calendar days to respond to a verifiable request, with one 45-day extension available if it notifies the employee within the original window. No fee may be charged. If the employer cannot verify the requester’s identity, it can deny the request but must explain why.

What Employers Have to Do

Notice at Collection

Before collecting any personal information from an employee, applicant, or contractor, the employer must deliver a Notice at Collection that identifies the categories of data being gathered, the specific business purposes for each category, and whether any of it will be sold or shared.⁹ If the employer later adds new categories or puts existing data to a materially different use, an updated notice has to go out first.

Privacy Policy

Covered employers must also maintain a comprehensive privacy policy that workers and applicants can easily reach.¹⁰ It should explain retention periods for each category of personal information, how sensitive data is processed, and how workers can exercise each of their rights. The CPPA has indicated that a consumer-facing policy will often not do the job on its own; employers may need to tailor the document to the employment context.

Collect Only What You Need

Under Section 1798.100(c), the collection, use, retention, and sharing of personal information must be “reasonably necessary and proportionate” to the purposes for which the data was gathered.¹¹ The CPPA advises employers to ask what the minimum amount of information actually required is, whether the data is already on hand before requesting more, and what harm could follow from over-collection. Gathering employee data “just in case” is the practice this standard targets.

Reasonable Security

Employers must implement and maintain security procedures appropriate to the volume and sensitivity of the data they hold. The statute does not prescribe a checklist, but courts look at whether the employer used encryption, access controls, and other industry-standard protections when weighing reasonableness.¹²

Where Federal Law Still Controls

The CCPA does not displace federal privacy regimes that already govern specific types of employee data. Three carve-outs matter most in the workplace:

Protected health information handled by a HIPAA-covered entity or business associate stays under HIPAA. An employer’s group health plan continues to run on the federal rules for that data.¹³
Information collected, maintained, or used by a consumer reporting agency under the Fair Credit Reporting Act falls outside the CCPA. Background check data processed through a third-party CRA is usually governed by the FCRA instead.¹³
Personal information already subject to the Gramm-Leach-Bliley Act and its implementing regulations is exempt from most CCPA provisions, though the private right of action for data breaches under Section 1798.150 still reaches GLBA-covered data.¹³

These exemptions are narrower than they look. They cover the specific data governed by the federal law, not the employer across the board. A company running a HIPAA-covered health plan still owes CCPA compliance for payroll records, performance reviews, geolocation logs, and everything else outside the federal regime.

What Noncompliance Costs

Private Lawsuits for Breaches

Data security is one of the few areas where employees can sue directly. If unencrypted personal information is accessed without authorization because the employer failed to maintain reasonable security, affected workers can file a civil action for statutory damages. The base statutory range is $100 to $750 per person per incident, or actual damages, whichever is greater. For 2025, the California Privacy Protection Agency adjusted the figures for inflation to $107 to $799 per person per incident.¹⁴ The amounts adjust annually with CPI. In a breach affecting thousands of employees, even the low end adds up quickly.

Before filing, the employee must give the employer 30 days’ written notice identifying the specific violation. If the employer cures the violation within that window and provides a written statement that no further breaches will occur, the lawsuit may be barred. The cure provision does not apply where the breach has already caused harm that cannot be undone.

Agency Fines

Beyond breach suits, the California Privacy Protection Agency can pursue administrative fines for any CCPA violation. The base statutory amounts are $2,500 per unintentional violation and $7,500 per intentional violation or any violation involving the data of a minor under 16. For 2025, those figures became $2,663 and $7,988, and they continue to rise annually with inflation.¹⁴

The per-violation structure is where exposure gets serious. Each affected employee, each category of mishandled data, and each missing or deficient notice can count as a separate violation. An employer that fails to deliver a Notice at Collection to 500 employees has not committed one violation; it has potentially committed 500. The CPPA has signaled through its early enforcement that workplace privacy obligations carry the same weight as consumer-facing ones.

1
State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act
2
California Legislative Information. California Civil Code 1798.140 – Definitions
3
California Privacy Protection Agency. What is Personal Information?
4
California Legislative Information. California Code CIV 1798.110 – Consumers Right to Know What Personal Information is Being Collected
5
California Legislative Information. California Code CIV 1798.106 – Consumer Right to Request Correction of Inaccurate Personal Information
6
California Legislative Information. California Code CIV 1798.105 – Consumers Right to Delete Personal Information
7
California Privacy Protection Agency. California Consumer Privacy Act of 2018 – Section 1798.121
8
California Privacy Protection Agency. California Consumer Privacy Act of 2018 – Section 1798.120
9
California Legislative Information. California Code CIV 1798.100 – General Duties of Businesses that Collect Personal Information
10
California Privacy Protection Agency. What General Notices Are Required By The CCPA?
11
California Privacy Protection Agency. Enforcement Advisory No. 2024-01
12
California Legislative Information. California Code CIV 1798.150 – Personal Information Security Breaches
13
California Legislative Information. California Code CIV 1798.145 – Exemptions
14
California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties