As covered employers work toward compliance, they should consider the following:

• Determine whether the law applies.
• Audit employment-related information practices. Create a data map that tracks what employment-related information is collected, what it’s used for, where it’s stored and who has custody over it. Keep in mind that “collecting” and “personal information” are defined by the law very broadly. “Collecting” includes both active and passive collection or receipt of information, and most, if not all, information collected from employees, applicants and contractors will qualify as “personal information” under the law.
• Identify service providers and contractors with whom employers may disclose employees’ personal information and work with legal counsel to ensure that contracts with those parties are compliant with the CPRA.
• Review the rights employees have under the CPRA, including any exceptions, and work with legal counsel to establish procedures and tools for receiving, processing and responding to CPRA requests from their personnel.
• Train the relevant personnel on employees’ and job applicant’s rights under the law and how to receive and process requests. Though businesses currently covered by the CCPA are already familiar with their training obligations and currently have systems and training in place for outside consumer requests, the extension of the law to employment-related information may entail training additional personnel that specifically handle such information.
• Ensure that you have compliant notice and disclosure policies in place for the new year. Employers should consult their legal counsel with specific questions regarding their disclosure notices, policies and procedures.
• Review and ensure the implementation of reasonable security measures to protect personal information from unauthorized access.

Employers can review CPRA resources and regulatory developments on the CPPA’s website.