Employee Data Under the CPRA: Rights, Requests, and Penalties

If you work in California for a mid-size or large employer, the California Privacy Rights Act gives you the right to see, correct, delete, and limit how your personal information is used, and to opt out of its sale or sharing. These CPRA employee data rights took effect on January 1, 2023, when a temporary carve-out for workforce information expired and pulled employees, job applicants, and independent contractors under the same protections California consumers already had.¹ The law reaches any California resident working for a covered business, with some federal carve-outs for data that other laws already regulate.

Is Your Employer Covered

Not every employer in the state is bound by the CPRA. A covered “business” is a for-profit entity that does business in California, collects personal information from California residents, and meets at least one of these thresholds:²

Annual gross revenue above $25 million in the preceding calendar year
Annually buys, sells, or shares the personal information of 100,000 or more consumers or households
Derives 50 percent or more of annual revenue from selling or sharing personal information

Most mid-size and large California employers clear the revenue threshold without difficulty. Smaller businesses may fall outside the law entirely. The statute uses “consumer” to mean any California resident, which is the mechanism that brings employees, applicants, and independent contractors into scope.²

What Counts as Your Personal Information at Work

The CPRA defines personal information broadly: anything that identifies, relates to, or could reasonably be linked to a specific person or household.² For workers, that covers the obvious HR file contents and much more: professional and employment-related information, internet and network activity, geolocation, and inferences drawn from any of that data to build a profile of you. If your employer tracks browsing on a company laptop or logs your badge swipes, that is covered data.

A separate category of sensitive personal information carries stronger protections. It includes:²

Social Security, driver’s license, and passport numbers
Financial account or card numbers combined with access credentials
Precise geolocation (GPS-level, not just city or zip)
Racial or ethnic origin, religious beliefs, or union membership
Biometric data such as fingerprints, facial recognition templates, or voiceprints used to identify you
Genetic and neural data
Health information collected and analyzed by the employer
Contents of personal mail, email, or text messages, unless the employer is the intended recipient

Fingerprint time clocks and GPS tracking on fleet vehicles produce sensitive personal information. The distinction matters because workers have a specific right to limit how an employer uses sensitive data, which does not exist for ordinary personal information.

Your Five Rights, Plus Protection From Retaliation

California workers get the same five core privacy rights that consumers have when dealing with retailers or tech platforms.³

Right to know. Ask for the specific pieces of personal information your employer has collected about you, where it came from, why it was collected, and which third parties received it. You can make this request up to twice a year at no cost.
Right to correct. Direct your employer to fix inaccurate information in your file.
Right to delete. Ask your employer to erase certain personal data. In the workplace, this has real limits: payroll records, workers’ compensation files, and other legally required data cannot simply be deleted. Surplus monitoring logs or outdated application materials are more realistic candidates.
Right to opt out of sale or sharing. Tell your employer to stop transferring your personal information to analytics vendors, advertising networks, or data brokers.
Right to limit use of sensitive personal information. Restrict your employer to using sensitive data only for purposes reasonably necessary to perform the job or deliver the services you expect, rather than for secondary profiling.

No Retaliation for Exercising These Rights

The CPRA expressly prohibits an employer from retaliating against any employee, applicant, or independent contractor who uses these rights.⁴ An employer cannot deny services, change your compensation, worsen your working conditions, or suggest that exercising a right will bring negative consequences. The anti-retaliation language names employees, applicants, and independent contractors directly.

What the Rights Look Like in Practice

In a consumer context these rights are straightforward. In employment, they get complicated fast. Your employer cannot delete your tax withholding records or stop processing your Social Security number for payroll. The CPRA accounts for this by letting employers retain data required for legal compliance, contract performance, and other necessary business functions. The deletion and limitation rights work best against data your employer collects but does not strictly need: workplace monitoring beyond what the job requires, location tracking that is not operationally necessary, or recruiting information that has outlived its purpose.

How to Make a Request

Most covered employers accept CPRA requests through a designated email address and a secure online portal. Decide first what you actually want: a full copy of what the company holds, correction of specific records, or deletion of particular categories. Clarity upfront saves you a round of back-and-forth that eats into the response window.

Your employer has to verify your identity before releasing anything. The CCPA regulations require businesses to establish and document a reasonable verification process, usually by matching information you provide against what the company already has on file.³ Current employees are typically easy to verify. Former employees may need to supply additional identifying information.

You can also designate an authorized agent — another person or a business registered with the Secretary of State — to submit the request for you. The employer may require signed proof of your authorization and may still ask you to verify your identity directly.³

Once your employer receives a request to know, delete, or correct, it has 45 calendar days to respond. The clock starts the day the request arrives, regardless of how long verification takes.⁵ A complex request can be extended by another 45 days, for 90 total, but only if the employer tells you about the extension and the reason within the original window. If the employer cannot verify your identity in the initial period, it can deny the request.

What Your Employer Must Tell You Before Collecting Data

Notice at Collection

Before or at the moment your employer first collects personal information from you, it must give you a written Notice at Collection. Without this notice, the employer cannot legally collect the data at all.⁶ The notice must state:

The categories of personal information being collected and the specific business purpose for each
Whether any of the information will be sold or shared with outside parties⁷
The categories and purposes of any sensitive personal information collected
How long the employer intends to keep each category, or the criteria used to decide⁸

That last point catches many employers out. The CPRA requires disclosing maximum retention periods, not just minimums, and bars keeping data longer than reasonably necessary for the stated purpose.⁸ An employer that installs keystroke-monitoring software has to tell you before the tracking starts and explain how long the data will be stored.

Privacy Policy

On top of the notice at collection, your employer must maintain a comprehensive privacy policy you can access. California Privacy Protection Agency guidance says the policy must cover the categories of personal information collected in the past 12 months, the sources, the purposes, and the categories of third parties who received the data.⁷ It must also explain each of your rights, describe how to exercise them, and show when it was last updated. Employers who publish a separate employee-specific notice, rather than directing workers to the consumer-facing policy, tend to meet these requirements more cleanly.

Penalties and When You Can Sue

Fines Imposed by the Agency

The California Privacy Protection Agency enforces the CPRA and can impose administrative fines of up to $2,500 per violation, or up to $7,500 for each intentional violation or any violation involving the information of someone the business knows is under 16.⁹ Those are per-violation amounts, which can scale quickly when an employer mishandles data for a whole workforce.

Suing Your Employer After a Data Breach

The CPRA gives workers a limited private right to sue, but only for data breaches. If your employer fails to maintain reasonable security and your unencrypted personal information is stolen or exposed as a result, you can recover statutory damages between $100 and $750 per person per incident, or your actual damages, whichever is greater.¹⁰ You do not have to prove identity theft or financial loss to collect statutory damages.

There is a procedural catch. Before filing for statutory damages, you must give your employer 30 days’ written notice identifying the provisions violated. If the employer actually fixes the problem within those 30 days and provides a written statement that the violation is cured and will not recur, you lose the right to sue for statutory damages on that breach.¹⁰ Tightening security after the fact does not count as a cure for a breach that already happened. If the employer breaks its written promise and the violations keep going, you can sue for damages on every subsequent breach.

Data That Other Federal Laws Already Cover

The CPRA does not duplicate every federal privacy regime. Health information handled by a covered entity or business associate under HIPAA’s privacy, security, and breach notification rules is carved out, so an employer self-administering a health plan under HIPAA does not face parallel CPRA obligations for that specific data. The exemption covers only information actually maintained under HIPAA standards. Health-adjacent data collected outside that framework, such as wellness survey responses stored in a general HR system, is still subject to the CPRA.

Background check information governed by the Fair Credit Reporting Act gets a similar exemption. When your employer pulls a credit report or criminal background check through a consumer reporting agency, that transaction is regulated by the FCRA rather than the CPRA. The exemption does not reach the employment decisions the employer makes using that information, or other data gathered during the same hiring process.

These exemptions apply to the data, not the employer. A healthcare company still has to comply with the CPRA for employee information outside HIPAA’s scope, including website cookies, marketing data, and general HR records that are not protected health information.

1
Bloomberg Law. Employment, Overview – CCPA/CPRA Scope for Employers, Employee Data
2
California Legislative Information. California Code CIV 1798.140 – Definitions
3
State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
4
California Legislative Information. California Code CIV 1798.125 – Consumers Right of No Retaliation Following Opt Out or Exercise of Other Rights
5
Legal Information Institute. Cal. Code Regs. Tit. 11, 7021 – Timelines for Responding to Requests to Delete, Requests to Correct, and Requests to Know
6
Legal Information Institute. Cal. Code Regs. Tit. 11, 7012 – Notice at Collection of Personal Information
7
California Privacy Protection Agency. What General Notices Are Required By The CCPA
8
California Legislative Information. California Civil Code 1798.100
9
California Legislative Information. California Code CIV 1798.155 – Administrative Enforcement
10
California Legislative Information. California Code CIV 1798.150 – Civil Action