California Employee Data Privacy and Breach Notification Rules
California employee-data compliance involves separate but connected responsibilities. Businesses subject to the CCPA need processes for workforce privacy rights, including extended-period requests. Organizations that own, license, or maintain covered computerized data must separately determine their duties under California’s breach-notification statutes.
Clear ownership, reliable incident facts, coordinated review, deadline management, and a documented decision record help teams demonstrate a defensible process.
Jump to Section
California employee privacy requests and breach notifications are governed by separate, related requirements. Businesses subject to the California Consumer Privacy Act, or CCPA, must account for employment-related personal information. A security incident involving that data may also trigger California Civil Code Section 1798.82, whether or not the organization is subject to the CCPA.
The distinction matters because each requirement has its own trigger, scope, workflow, and deadline. CCPA requests to know, delete, or correct generally require a response within 45 calendar days. By contrast, a covered breach generally requires notice to affected California residents within 30 calendar days after discovery or notification.
Privacy, legal, human resources, security, and operations teams should connect these processes through shared data maps, clear ownership, and defensible documentation while evaluating each obligation separately.
Updated October 2026
Three California employee-data obligations to manage separately
Employee privacy rights under the CCPA. The California Privacy Rights Act amended the CCPA; it did not replace the CCPA with a separate law. The temporary exemptions for employment-related and business-to-business personal information expired December 31, 2022.
Extended requests to know. A request to know generally covers personal information collected during the preceding 12 months. A requester may also seek information collected on or after January 1, 2022, beyond that 12-month period, subject to statutory and regulatory limitations.
Breach notification. California Civil Code Section 1798.82 separately governs notice following certain unauthorized acquisitions of covered personal information. The obligation turns on the organization’s role, the affected information, and the facts of the incident, not simply on whether the affected individual is an employee.
Does the CCPA cover employee data?
Yes. The California Privacy Protection Agency confirms that the employment-related and business-to-business exemptions expired at the end of 2022. Businesses subject to the CCPA must therefore address personal information collected in employment contexts, including information about employees, applicants, and independent contractors.
Depending on the circumstances and applicable exceptions, California residents may have rights to:
- Know what personal information a business has collected
- Delete certain personal information
- Correct inaccurate personal information
- Opt out of the sale or sharing of personal information
- Limit certain uses and disclosures of sensitive personal information
- Receive equal treatment when exercising their rights
These rights do not create a blanket requirement to obtain employee consent before every collection of personal information. The CCPA generally requires a notice at or before collection that identifies the categories of personal information collected, the purposes for which the information will be used, applicable sale or sharing practices, and the intended retention period or the criteria used to determine it.
Consent is required in particular circumstances, but it should not be presented as the universal legal basis for ordinary workforce-data collection.
What does the CCPA’s extended look-back rule require?
Under the current CCPA regulations, a business responding to a request to know generally must provide personal information it collected and maintains about the requester during the 12 months preceding the request.
The requester may ask for an earlier period, including information collected on or after January 1, 2022. The extended period is not automatic in every response; the request must identify or encompass the longer period.
How long does a business have to respond?
A business generally must respond to a request to know, delete, or correct within 45 calendar days of receiving it. The response period begins when the business receives the request, regardless of how long identity verification takes.
When necessary, the business may take up to 45 additional calendar days, for a maximum of 90 calendar days total. It must notify the requester and explain why it needs additional time.
When may a business deny an extended-period request?
A business does not have to provide information from the extended period when doing so would be impossible or require disproportionate effort. It must give the requester a detailed explanation containing enough facts to provide a meaningful understanding of the decision. A conclusory statement is not sufficient.
The CCPA also does not require a business to retain personal information solely to answer a future request.
Operational readiness therefore depends on more than the ability to search older records. Businesses need reliable identity verification, workforce-data maps, documented retention rules, exception review, and evidence showing how each response decision was reached.
When does California’s breach-notification law apply?
California’s data breach reporting guidance explains that an individual or business doing business in California that owns or licenses computerized data generally must notify an affected California resident when an unauthorized person acquired, or is reasonably believed to have acquired, covered unencrypted personal information.
Encrypted information may also trigger notice when:
- The encryption key or security credential was acquired or is reasonably believed to have been acquired by an unauthorized person; and
- The organization reasonably believes the key or credential could make the personal information readable or usable.
An organization that maintains covered computerized data it does not own has a different obligation. It must notify the data’s owner or licensee immediately after discovering a covered acquisition. That distinction should be reflected in vendor contracts and incident-escalation procedures.
The legal analysis depends on the statutory data elements and the incident facts. It does not turn on whether the affected resident is categorized as a customer or employee, and it is separate from whether the organization qualifies as a business under the CCPA.
What are California’s 2026 breach-notification deadlines?
Senate Bill 446, enacted in 2025 and effective January 1, 2026, added express deadlines to Section 1798.82.
Notice to affected California residents generally must be provided within 30 calendar days after discovery or notification of the breach.
An individual or business may delay notice:
- To accommodate legitimate law-enforcement needs; or
- As necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
When a single breach requires notice to more than 500 California residents, the organization must electronically submit one sample copy of the resident notice to the California Attorney General. The sample must exclude personally identifiable information. The submission is due within 15 calendar days after affected residents are notified.
The 15-day California Attorney General period begins after resident notification. It does not extend the 30-day period for notifying affected residents.
CCPA workforce rights versus breach notification
| Question | CCPA workforce privacy | Section 1798.82 breach notification |
| Primary trigger | A privacy-rights request or another applicable CCPA obligation | Unauthorized acquisition, or reasonable belief of acquisition, of covered personal information |
| Covered organization | A business subject to the CCPA | An individual or business conducting business in California that owns or licenses covered computerized data; maintainers have a separate owner-notification duty |
| Key timing | Generally 45 days, with a possible extension to 90 days | Generally 30 calendar days; qualifying California Attorney General submission within 15 days after resident notice |
| Core output | Verified access response, correction, deletion, opt-out, limitation, or other applicable action | Statutory notice to affected residents and, when required, a sample filing with the attorney general |
| Core evidence | Identity verification, data sources, exceptions, actions taken, and response rationale | Incident facts, affected data, acquisition analysis, timing, approvals, and notice records |
A practical California employee-data readiness checklist
A defensible program connects privacy-rights operations with incident response without collapsing them into the same workflow.
Map workforce data. Identify the systems, owners, vendors, data categories, locations, and retention periods associated with applicant, employee, contractor, and former-employee information.
Align notices with actual practices. Confirm that workforce notices at collection accurately describe collection, use, retention, disclosure, sale, and sharing practices.
Operationalize privacy requests. Define identity verification, routing, exception review, approvals, response production, and documentation for workforce requests.
Prepare for extended-period requests. Ensure that personal information collected on or after January 1, 2022, can be located when required without retaining it longer than justified by business and legal needs.
Clarify owner and maintainer responsibilities. Document which party owns or licenses each dataset and which parties merely maintain it. Reflect notification and cooperation duties in vendor contracts.
Standardize incident intake. Capture affected residents, data elements, encryption status, acquisition facts, discovery date, data ownership, and system-restoration milestones.
Track both breach-notification clocks. Monitor the 30-day resident-notice period and, when more than 500 California residents are notified, the 15-day period for submitting the sample notice to the California Attorney General.
Preserve the rationale. Record the facts, legal analysis, exceptions, approvals, communications, and evidence supporting each notification decision.
Build incident response into risk management
NIST Special Publication 800-61 Revision 3 recommends integrating incident response throughout cybersecurity risk management activities.
For privacy teams, that means preparing before an incident occurs. Organizations should define roles, establish information flows, test escalation paths, and make the evidence needed for regulatory decisions available to the appropriate reviewers.
Human resources, privacy, legal, security, and operations should agree on who owns each decision and how information moves among teams. Exercises should test more than technical containment. They should also evaluate:
- The completeness and reliability of incident facts
- The speed of legal escalation
- Data-owner and data-maintainer responsibilities
- Notice production and approval
- Deadline tracking
- Preservation of the decision record
How RadarFirst supports consistent incident decisions
RadarFirst’s privacy incident management platform connects incident intake, assessment, regulatory intelligence, review, and documentation in one workflow.
Structured intake helps privacy, legal, security, HR, and operations teams capture the facts needed for legal analysis. Guided assessments and jurisdiction-specific regulatory mapping help teams evaluate potential notification obligations, while configurable workflows route decisions to the appropriate reviewers and track critical deadlines.
RadarFirst also preserves the facts, analysis, approvals, and supporting documentation behind each decision. This creates proof of diligence and gives qualified privacy and legal professionals a consistent record on which to base the final determination.
Strengthen your California incident-response workflow
See how RadarFirst helps privacy, legal, security, and HR teams capture consistent incident facts, apply regulatory intelligence, coordinate review, and preserve the rationale behind each notification decision.
Explore the RadarFirst platform
Sources
- California Privacy Protection Agency, Frequently Asked Questions
- California Consumer Privacy Act regulations, effective January 1, 2026
- California Attorney General, Data Security Breach Reporting
- California Legislature, SB 446
- NIST SP 800-61 Revision 3
- RadarFirst Platform
This article provides general information and is not legal advice. Organizations should confirm applicability, exceptions, and current requirements with qualified counsel.
Frequently asked questions
Does every employee-data incident require notification?
No. Notification depends on whether the incident meets the definitions and trigger conditions in the applicable breach-notification statute. Relevant factors include the type of personal information involved, whether it was encrypted, and whether an unauthorized person acquired it or is reasonably believed to have acquired it.
Does the 30-day breach deadline replace the CCPA request deadline?
No. The deadlines govern different events. Covered CCPA requests generally have a 45-day response period. A covered breach generally requires notice to affected California residents within 30 calendar days after discovery or notification.
Does a business have to keep employee data indefinitely for CCPA requests?
No. The extended look-back rule does not require a business to retain personal information solely to respond to a future request. Retention should remain tied to documented business and legal needs.
When must a breach notice be submitted to the California Attorney General?
When a single breach requires notice to more than 500 California residents, submit one sample copy of the notice electronically to the California Attorney General within 15 calendar days after notifying affected residents.
Related Posts
Insights on Privacy, AI Risk, and Compliance
Let’s Get Started
Trusted by leading organizations, RadarFirst enables teams to manage incidents with speed, consistency, and defensibility by standardizing how incidents are captured, assessed, and actioned.
