CCPA employee data: how do you refresh your employee privacy notice?

Does the CCPA apply to employee data?

Yes. Since January 1, 2023, CCPA employee data has had full protection. A business covered by the California Consumer Privacy Act owes its California employees, job applicants and independent contractors the same notices and rights as any other consumer. The partial exemption for workforce data in Civil Code section 1798.145(m) became inoperative on that date.

California's privacy agency, now operating as CalPrivacy, restated the point in its April 2026 invitation for comments: CCPA requirements "also apply to businesses' processing of employees' personal information," including the privacy policy, the notice at collection and notices about how to exercise privacy rights.

Coverage starts with the definition of a business. The most common test is annual gross revenue above $26,625,000, the threshold as adjusted on January 1, 2025. RIAs and broker-dealers often ask whether the CCPA's GLBA exemption takes them out of scope. That exemption covers personal information collected under GLBA. Employee and applicant data is generally not collected under GLBA, so a financial firm that meets a threshold usually has employee notice obligations even when its client data is exempt. Our guide to the CCPA GLBA exemption explains where that line falls.

What must a CCPA employee privacy notice include?

A CCPA employee privacy notice, called a notice at collection in the regulations, has to tell workers what you collect, why, and how long you keep it, and it has to reach them at or before the point of collection. Section 7012 of the CCPA regulations lists the required contents:

• The categories of personal information to be collected.
• The purposes for which each category is collected and used.
• Whether each category is sold or shared.
• How long the business intends to retain each category, or the criteria used to set that period.
• A link to the privacy policy, and a link to the opt-out notice if the business sells or shares personal information.

Timing matters. Section 7012(d) says that if a business does not give the notice at or before collection, it "shall not collect personal information from the consumer." For applicants, that point is usually the careers page or the applicant tracking system. For new hires, it is onboarding. Offline collection can use a printed form or an oral notice, as long as the notice tells people where to find the full privacy policy online.

Retention is the field employers most often leave vague. Section 1798.100(a)(3) requires the retention period for each category, and section 1798.100(c) limits collection and use to what is "reasonably necessary and proportionate" to the stated purpose.

How often must a CCPA privacy policy be updated?

At least once every 12 months. Section 1798.130(a)(5) requires a business to update the information in its privacy policy at least annually, and section 7011(e)(4) of the regulations requires the policy to show the date it was last updated.

A privacy policy that still shows a 2024 date is an easy finding for a regulator. Year-end is a natural point to review it, because the HR systems, benefits vendors and recruiting tools in use often change during the year.

What has changed since your last employee privacy notice?

Three things have changed for most firms: the CCPA regulations were amended effective January 1, 2026, ADMT requirements for hiring and other significant decisions begin January 1, 2027, and new HR and AI tools are collecting workforce data the old notice does not describe.

First, the regulations themselves. CalPrivacy's updated CCPA regulations were approved on September 22, 2025 and took effect January 1, 2026. If your employee notice was last revised before then, it was written against the earlier text.

Second, automated decisionmaking. Businesses that use automated decisionmaking technology to make significant decisions, including hiring, allocation of work, compensation, promotion and termination, must comply with the ADMT requirements in sections 7200 through 7222 beginning January 1, 2027. That includes a pre-use notice. Our guide to the CCPA ADMT rules covers what counts as ADMT and how human review affects it.

Third, your own tools. AI notetakers, endpoint and email monitoring, background check services, HR platforms and benefits portals all collect workforce data. Each one may add a category, a source or a purpose that the notice has to describe.

Does CalPrivacy enforce job applicant privacy notices?

Yes. On September 30, 2025, the agency's board required Tractor Supply Company to pay a $1,350,000 fine. Among the violations listed was failing to notify California job applicants of their privacy rights and how to exercise them. The agency described the decision as the first to address CCPA privacy notices and privacy rights of job applicants.

Administrative fines are calculated per violation. As adjusted in 2025, the CCPA allows up to $2,663 per violation and up to $7,988 per intentional violation. A notice missing from every application in a hiring cycle can add up quickly.

Is CalPrivacy planning new rules for employee data?

Possibly, but nothing has been proposed yet. CalPrivacy opened a preliminary comment period on notices, disclosures and employee data on April 20, 2026, which closed on May 20, 2026. The agency says it is "exploring whether regulatory changes relating to employee data are necessary." As of this writing, its regulations page lists no proposed regulation packages. Plan to update your notice against the current rules now and revisit it if a formal proposal appears.

How do you update an employee privacy notice this quarter?

Give the project one owner across HR, legal and IT, and work through these steps:

• Inventory the systems that hold workforce data: HRIS, payroll, benefits, recruiting, Microsoft 365, monitoring and security tools, and any AI tools staff use.
• Map each system to the categories of personal information it holds, the source and the purpose.
• Set a retention period, or retention criteria, for each category. Coordinate with the record retention rules your industry already follows.
• Update the employee notice at collection and the applicant notice, and confirm the applicant notice appears where people apply.
• Update the workforce section of your privacy policy and change its last-updated date.
• Confirm HR knows how to receive and verify employee requests to know, delete and correct, and how to respond within the CCPA's timelines.
• Check that vendor contracts for HR and payroll systems include the service provider terms the CCPA requires.
• List any tool that could be ADMT used for significant decisions and plan for the January 1, 2027 requirements.

This describes what the statute and regulations require. Your counsel should confirm how they apply to your firm.

How s90 helps

Most of the work in an employee privacy notice is knowing where workforce data actually lives. s90 helps firms inventory HR and IT systems, document data flows and retention settings, and keep the evidence ready, including our commitment to produce evidence within 24 hours when it is needed. If your employee notice is due for its annual refresh, we can help you build the inventory behind it.