California Attorney General enforces CCPA on employers after exemption ends

What happened

- The California Consumer Privacy Act originally exempted employee data until a temporary waiver in Assembly Bill 25 lapsed. - On 1 January 2023 the exemption ended, so the CCPA’s privacy and data‑security requirements now apply to employee information. - Employers must treat employee data as consumer data for purposes of collection, use, disclosure, and breach notification.

Why it matters

Employers across California will need to extend their privacy programs to cover employee records, mirroring consumer‑data obligations such as notice, access, and security safeguards.

Business impact

Compliance costs will rise as HR systems must be audited, employee privacy notices updated, and data‑security controls enhanced to meet CCPA standards.

What to check

1. 1

   audit employee data practicesHigh priority

   Map all employee personal information flows and compare them against CCPA requirements.

2. 2

   update privacy noticesHigh priority

   Add clear disclosures about employee data collection, use, and sharing in line with CCPA.

3. 3

   enhance security controlsMedium priority

   Implement technical and organizational measures to protect employee data from unauthorized access.

4. 4

   establish breach response for employee dataMedium priority

   Include employee records in breach notification procedures and timelines.