Does the CCPA apply to employee data?

For its first years the CCPA left most workplace data alone. A temporary carve-out meant that if you collected personal information about your own employees, it sat outside the law. That carve-out is gone. Since January 1, 2023, employee, applicant, and business contact data is treated like any other personal information the CCPA covers, and a lot of businesses have not caught up.

What changed on January 1, 2023?

Two temporary exemptions expired. California Civil Code section 1798.145(m) exempted personal information a business collected about a person acting as a job applicant, employee, owner, director, officer, medical staff member, or contractor. Section 1798.145(n) exempted business-to-business communications and transactions. Each subdivision ended with the same instruction: it "shall become inoperative on January 1, 2023." The Legislature had a deadline to extend them and did not. So on that date both exemptions switched off by their own terms, and the data they had shielded came within the CCPA.

Does the CCPA apply to your business?

Coverage still turns on the thresholds in section 1798.140(d). You are a covered business if you are for-profit, do business in California, and meet at least one test: more than $25 million in gross annual revenue in the preceding calendar year; buying, selling, or sharing the personal information of 100,000 or more consumers or households a year; or deriving 50 percent or more of annual revenue from selling or sharing personal information. If you meet one of these, employee and applicant data now counts toward your obligations, not against a special exemption.

What rights do employees and applicants have now?

The same core rights as any consumer. Employees, former employees, applicants, and contractors can ask to know what you collect and why, ask you to delete personal information you collected from them, ask you to correct it, and opt out of any sale or sharing. They are also owed a notice at collection at or before the point you gather their data, describing the categories, purposes, and how long you keep each one.

What about business-to-business contacts?

The section 1798.145(n) exemption that covered communications with people acting for another company also lapsed on January 1, 2023. Contact records for your vendors, partners, and prospects are personal information about individuals, so they carry the same rights. Marketing and sales databases full of business contacts are a common blind spot, because teams assume "B2B" means the CCPA does not apply. It does.

Next step

If you are unsure whether the CCPA now reaches your HR or B2B data, the free 2-minute Obligation Scan checks whether your business meets a threshold and lists the notices, rights processes, and retention steps you owe, so employee data does not become the gap an enforcer finds. The US state privacy laws hub shows how California compares with the other states you may operate in.