Employee Data Privacy: What US Employers Must Do
Employee data privacy for US employers: the state law patchwork, why California is different, medical and biometric rules, breach duties, disposal.
The first time an employee asked me exactly what personal data we held about him, I did not have a good answer. I knew where his signed offer letter was. I could not have told you, without an afternoon of digging, every place his home address, his bank details and a scanned copy of his passport had been copied to over eighteen months.
That gap was not a compliance failure in any technical sense. Nobody had breached anything. But it was the moment I understood that the file cabinet metaphor most small employers carry around is wrong. Employee data is not in a file. It is in a payroll system, a benefits portal, three shared drives, an email thread from the week he was hired, and a spreadsheet a manager built and never told anyone about.
This guide gives you the answer I lacked: what a US employer owes its own staff on privacy. It covers where the obligations come from when there is no single law, which state rules reach your workforce records and which ones deliberately do not, what you must be able to do when someone exercises a right, and the categories of data that carry their own rules no matter where you operate.
I built the document handling in FirstHR around this problem, because the honest state of most small companies is not carelessness. It is not knowing where anything is.
What Employee Data Privacy Requires of an Employer
Employee data privacy is the set of duties an employer owes regarding the personal information it collects about its own workforce: collect only what you need, tell people what you collect, keep the sensitive categories separate, protect it, hand it over or delete it when someone has a legal right to ask, and notify people when it leaks. Those six duties are the whole of it.
What makes this hard is not the concept. It is that no single statute states those six duties in one place. An employer in the European Union reads one regulation. An employer in the United States reads a federal medical confidentiality rule, a federal background check statute, a state breach law, possibly a state biometric law, possibly a state comprehensive privacy law, and a contract with a payroll provider.
The result is that most small employers do privacy by accident. They keep medical notes in the wrong folder because nobody told them the Americans with Disabilities Act (ADA) cared. They email a scanned driver license to a manager because it was faster. They hold a terminated employee’s bank details for six years because deleting things takes effort. None of that is malicious, and all of it is exposure.
The upside is that the underlying work is finite. A small business can build a defensible privacy posture in a few focused sessions, and most of it is one-time setup rather than ongoing labor. The trick is to organize around data categories rather than around laws, because a category can be handled once while the laws keep changing.
Why There Is No Single US Employee Privacy Law
There is no federal employee privacy statute because Congress never passed one. What exists instead is a set of laws each written to solve one narrow problem, layered over state laws written at different times for different reasons, layered over contract terms and common law tort claims. Five distinct sources of obligation reach the same employee record.
The sources do not overlap cleanly. The ADA reaches medical data whether or not any state privacy law applies. A breach notification law reaches every employer in the state regardless of revenue. A comprehensive privacy law may reach nothing in your HR file at all. Compliance is not a single test you pass.
One recurring confusion is worth clearing up early. HIPAA (the Health Insurance Portability and Accountability Act) does not govern your personnel records. The privacy rule excludes employment records held by a covered entity in its role as employer from the definition of protected health information, which means the health plan side is regulated and the HR side is not.
The practical translation: an employer who says "we are not covered by HIPAA, so employee health data is unregulated" has drawn the wrong conclusion from a correct premise. The ADA still applies, state medical confidentiality laws still apply, and a breach of health information can still trigger notification under state breach laws. HIPAA is simply not the statute doing the work.
State Privacy Laws and Why California Is the Outlier
Roughly twenty states now have comprehensive consumer privacy laws in force, and with a single exception none of them reach employee data. Each one defines the protected "consumer" as an individual acting in a personal or household capacity and expressly excludes people acting in a commercial or employment context, which puts employees, applicants and contractors outside the law.
California is the exception, and the exception is total. The California Consumer Privacy Act (CCPA) originally carried a temporary carve-out for workforce data. That carve-out expired at the end of 2022 and was not renewed.
A covered California employer now owes its employees, applicants, independent contractors, directors and their beneficiaries the same rights it owes a retail customer. The California Attorney General publishes the current rights list.
Several more state-level layers ignore the employment exemption entirely, and these are the ones that catch small employers by surprise. Biometric rules, Colorado’s among them, reach employers directly. Breach notification statutes exist in all fifty states plus the District of Columbia and apply to any business holding resident data. Personnel file access laws in many states give employees a right to inspect their own file.
So the useful question is not "does my state have a privacy law." It is two questions. First, does a comprehensive privacy law reach my workforce data? For now that means asking whether you have California staff and whether you meet the thresholds. Second, which sector-specific state rules apply to the data types you actually hold? Every employer has to answer that one.
| Layer of law | Does it reach employee data? | What triggers coverage | What you owe |
|---|---|---|---|
| California CCPA | Yes, in full since the exemption lapsed | Revenue, resident volume or data-sale revenue thresholds | Notice at collection plus access, deletion, correction, opt-out and limitation rights |
| Other state comprehensive privacy laws | No, employment context is excluded | Not applicable to workforce records | Nothing for staff data, though customer data may still be covered |
| State breach notification laws | Yes, everywhere | Holding personal data about a resident of that state | Notice to affected individuals, often to the attorney general above a threshold |
| State biometric laws | Yes, and aimed squarely at employers | Collecting fingerprints, face or voice scans | Written policy, informed consent before collection, retention schedule, destruction |
| State personnel file access laws | Yes, in many states | Being an employer in that state | Let the employee inspect or copy the file within the statutory window |
| State SSN protection laws | Yes, in many states | Holding Social Security numbers | Restrictions on display, transmission and disposal |
What the Rights Mean in Practice and How to Answer a Request
Four rights matter operationally: notice at collection, access, deletion and correction. Notice is the one you owe before anyone asks. The other three are reactive, and each requires you to be able to find every copy of a person’s data across every system inside a fixed window.
Notice at collection means a written statement, delivered at or before the moment you collect, listing the categories of personal information you collect, the purpose of each category, whether any of it is sold or shared, and the retention period or the criteria you use to set one. For an employer this belongs in the new hire paperwork packet, acknowledged and filed alongside the rest of the personnel file.
Access means the employee can ask what you hold and receive it. Deletion means they can ask you to erase it, subject to a long list of exceptions that let you keep what the law requires you to keep. Correction means they can require you to fix inaccurate information. None of the three is absolute, and all three require documented reasoning when you say no.
The request itself is where small employers fail, and the failure is almost never legal. It is logistical. The clock starts when the request arrives, not when you get around to it, and the search has to reach systems you do not control. Here is the sequence that actually works.
Two details deserve emphasis. Verify identity before you disclose anything, because handing an employee record to someone impersonating that employee is itself a breach. And suspend routine deletion the moment a request lands, because destroying responsive records after a request is a much worse fact pattern than holding data too long.
Everything above only works if somebody writes it down while it is happening. Open one of these the day a request arrives and fill it in as you go, because the parts you will be asked to justify later are the dates, the verification, and the reasoning behind anything you withheld.
Outside California, the analogous right usually comes from a state personnel file access statute rather than a privacy law. Those are narrower: they cover the personnel file specifically, set their own deadlines, and often permit a copying charge. The process above still serves you, because a single well-run intake path handles both without you having to remember which law is in play.
The Data Categories That Carry Their Own Rules
Five categories of employee data carry their own federal or state rules, which apply regardless of whether any comprehensive privacy law reaches you: medical information, immigration documents, background check data, Social Security numbers and biometric identifiers. Getting these five right resolves most of your exposure.
Medical information is the strictest and the most commonly mishandled. Under the ADA, anything obtained through a medical inquiry or examination must be collected on separate forms, held in separate medical files, and treated as a confidential medical record. That requirement sits in the Code of Federal Regulations at 29 CFR 1630.14, and it is not a best practice. It is the rule.
The scope is broader than people expect. Accommodation requests, doctor’s notes, fitness-for-duty certifications, workers’ compensation records, drug and alcohol test results, health plan enrollment forms and anything from a wellness program all belong in the confidential medical file. GINA extends the same separation to genetic information, including family medical history you learn about incidentally.
Drug tests need one clarification. The ADA does not treat a test for illegal drug use as a medical examination, but any other medical information such a test turns up is confidential under 29 CFR 1630.16(c), so that information still belongs in the separate file.
Immigration documents follow their own logic. Form I-9 must be produced for government inspection on as little as three business days’ notice, so U.S. Citizenship and Immigration Services (USCIS) recommends keeping I-9s in a separate binder or folder for all employees, not inside individual files. Copies of the underlying documents, if you take them, must be kept consistently for everyone.
Background check data is governed by the Fair Credit Reporting Act whenever the report comes from a screening company. The FCRA requires a standalone written disclosure, written authorization, a pre-adverse action notice with a copy of the report before you act, and a final adverse action notice after. The Federal Trade Commission (FTC) publishes the employer guidance.
Social Security numbers are the highest-value item in your file and the one employers tend to handle most casually. There is no single federal statute restricting employer use, but many states restrict public display, transmission over unsecured channels and printing on documents. Store the numbers encrypted, show them to payroll only, and keep them out of every email body and spreadsheet column.
The fifth category, biometric identifiers, gets its own section after this table. The table puts the rules for all five in one place, with two close relatives added: genetic information, which GINA treats alongside medical data, and payroll and bank details.
| Data category | What rule governs it | Where it should live | How long you keep it |
|---|---|---|---|
| Medical, accommodation, workers’ comp | ADA, 29 CFR 1630.14; state medical confidentiality laws | Separate confidential medical file, restricted to one or two people | Per the record-specific rule, then destroy; never merged into the personnel file |
| Genetic and family medical history | GINA Title II, 29 CFR 1635.9 | Same confidential medical file as ADA material | Same as other medical records, kept apart from performance data |
| Form I-9 and supporting copies | Immigration Reform and Control Act; 8 CFR 274a.2 | Separate I-9 file or binder covering all staff | Three years after hire or one year after termination, whichever is later |
| Background check reports | FCRA, 15 USC 1681b; FTC Disposal Rule, 16 CFR 682 | Separate confidential file, not the personnel file | Long enough to defend the hiring decision, then disposed of by shredding or wiping |
| Social Security numbers | State SSN protection and disposal laws | Payroll system field, encrypted, role-restricted | As long as tax and payroll rules require, then purged from ad hoc copies |
| Biometric identifiers | State biometric statutes, notably Illinois BIPA | Vendor system under a written policy and signed consent | Per your published retention schedule, destroyed when the purpose ends |
| Payroll and bank details | State breach and SSN laws; vendor contract | Payroll provider only, never in email or a shared sheet | Per payroll record rules, then removed from any secondary copies |
Note the pattern running through that table. Almost every category has a natural home outside the main personnel file, and almost every failure happens when someone puts it in the main file for convenience.
Biometric Data Is Where the Litigation Risk Actually Lives
Biometric data is the one employee privacy category that reliably produces expensive litigation, because Illinois gives employees a private right of action (the right to sue directly) and most other privacy rules do not. If you use a fingerprint time clock, a face scan for door access or voiceprint authentication, this is the section that matters most.
The Illinois Biometric Information Privacy Act requires a written policy that is publicly available, states a retention schedule and destruction guidelines, and obtains informed written consent before the first collection.
Statutory damages under the act run to $1,000 per negligent violation and $5,000 per intentional or reckless violation, and the Illinois Supreme Court held in 2019 that the plaintiff does not have to show any actual harm.
An amendment signed in 2024 narrowed the exposure considerably. Repeated collection of the same identifier from the same person by the same method now counts as one violation rather than one per scan, which had been the theory behind the largest damages demands.
The same amendment means an electronic signature now counts as a valid written release. The statute remains the most dangerous in the country for employers, but the arithmetic is no longer absurd.
Other states regulate biometric data without the private right of action. Texas imposes notice and consent duties under its capture of biometric identifiers statute. Washington’s law is narrower, reaching only identifiers enrolled in a database for a commercial purpose, and RCW 19.375.030 states plainly that the chapter may be enforced solely by the attorney general.
Colorado took a different route. It wrote employer biometric rules into its privacy act, effective July 1, 2025, and they reach employees even though the rest of that statute exempts employment data. Only the attorney general and district attorneys can enforce them.
The operational rule is short. Before you switch on any device that reads a body part, check the states where your staff physically work, publish a policy, collect a signed consent from every person enrolled, and confirm in writing what your vendor does with the stored scans. A time clock is not worth a class action.
Breach Notification: What You Must Do and How Fast
Every state plus the District of Columbia has a breach notification law, and every one of them applies to employee data the same way it applies to customer data. If personal information about a resident of that state is acquired by an unauthorized person, you owe notice, and the deadline is set by the law of the employee’s state rather than yours.
Most statutes use a standard of the most expedient time possible and without unreasonable delay. Several set a hard outside limit. Colorado and Florida both require notice within thirty days of determining that a breach occurred, and both require notice to the state attorney general when five hundred or more residents are affected. Florida allows an additional fifteen days for good cause submitted in writing.
The scenario that catches employers is not a hacker. It is a laptop left in a car, a payroll file emailed to the wrong address, an ex-employee whose access was never revoked, or a vendor incident that surfaces weeks later. A proper offboarding checklist closes the ex-employee case, and treating payroll security as a separate discipline addresses the misdirected payroll file.
Dwight SchruteSales3 people
Darryl PhilbinWarehouse1 person
Kelly KapoorCustomer Service1 personRetention and Secure Disposal
Privacy law and records law point in opposite directions, and holding both ideas at once is the whole discipline. Records law sets floors: keep this document for this long. Privacy law sets a ceiling: do not hold personal data past the purpose you collected it for. Your schedule lives in the space between the two.
I am not going to restate the retention periods here, because they belong in one place and that place is our record retention guide. What matters for privacy is the other half of the schedule: the disposal column. A retention schedule with no disposal step is not a schedule. It is an accumulation policy with better formatting.
Secure disposal has a specific legal meaning for some data. The FTC Disposal Rule at 16 CFR Part 682 requires reasonable measures to protect against unauthorized access when you dispose of information derived from a consumer report, which for an employer means background check results. Qualifying measures include shredding, burning or pulverizing paper and wiping or destroying electronic media. Handing a box to the recycling company does not qualify.
Many states add their own disposal requirements for records containing Social Security numbers or other identifiers, and the standard is similar: render the information unreadable. The practical version for a small business is a cross-cut shredder for paper, a documented wipe procedure for drives, and a written note of what was destroyed and when.
One rule overrides the entire schedule. The moment you reasonably anticipate litigation, an agency charge or an audit, you place a legal hold, an instruction to preserve records, and stop destroying anything potentially relevant, including automated deletion routines. Destroying records after a claim becomes foreseeable turns a defensible case into spoliation (the legal term for destroying evidence), and courts punish that far harder than they punish the underlying dispute.
Monitoring and What You Have to Disclose First
You can monitor company systems in most circumstances, but in several states you must tell employees in writing before you start, and everywhere you are far better off having disclosed it. Monitoring conducted without notice is the fastest route from an ordinary employment dispute to a privacy claim.
New York requires employers who monitor telephone conversations, email or internet usage to provide written notice upon hiring, acknowledged by the employee in writing or electronically.
New York’s attorney general enforces Civil Rights Law section 52-c with civil penalties of up to five hundred dollars for a first offense, one thousand for a second and three thousand for each one after that. Connecticut and Delaware impose their own notice requirements with different mechanics.
The federal baseline is more permissive. The Electronic Communications Privacy Act permits interception where one party consents and provides a business use exception for equipment used in the ordinary course of business. Consent is much easier to prove when it is a signed acknowledgment than when it is an inference from a handbook nobody opened.
Two boundaries hold almost everywhere. Do not monitor what you did not disclose, and do not claim monitoring rights you never exercise, because an overbroad policy invites the argument that you were reading things you had no business reading. Restrooms, changing areas and personal devices you do not manage stay off limits regardless of what the handbook says.
Vendors: What Your Payroll or Benefits Provider Does With the Data
Your vendors hold the same sensitive data you do, and in most states the notification duty after their breach lands on you rather than on them. Breach statutes typically place the obligation on the entity that owns or licenses the data and require the holder to notify the owner so the owner can notify the affected people.
That single legal detail should change how you buy software. A payroll provider, a benefits administrator, a background screening company and an HR platform each hold names, Social Security numbers, bank details and sometimes health information. If any of them is compromised, your employees receive a letter with your company name at the top, and your contract decides who pays for it.
There are six questions worth asking before you sign anything that touches employee data, and any provider worth using answers all six without hesitation. The first one, about subprocessors, asks which other companies your vendor passes your data to. Put all six to the vendor in writing, keep the answers, and revisit them at renewal rather than never.
| Ask the vendor | What a good answer looks like | What should worry you |
|---|---|---|
| Which subprocessors touch our employee data? | A current written list with locations, updated when it changes | A vague reference to trusted partners with no names |
| What is your breach notification commitment to us? | A specific number of hours from determination, written into the contract | Prompt notice with no defined time frame |
| Can we see your security documentation? | A current independent audit report or certification, provided under NDA | Marketing pages about bank-level encryption and nothing else |
| Where is the data stored and who can access it? | Named regions, role-based access controls, logged administrative access | Cannot say, or support staff have standing access to production data |
| What happens to our data when we leave? | Export in a usable format, then deletion within a stated window, confirmed in writing | Data retained indefinitely or deleted on an unspecified schedule |
| Who indemnifies notification costs after your incident? | The vendor, with a cap you can live with | You do, or liability is capped at one month of fees |
One structure deserves extra scrutiny. If you use a professional employer organization, the co-employment relationship means a third party holds your entire workforce record set, so read the data terms in the service agreement rather than assuming.
Consolidating systems works in your favor. It is itself a privacy control, since fewer copies means fewer places to search and fewer places to lose, which is the quiet argument for a single human resources information system (HRIS) over five disconnected tools.
The Privacy Program a Small Business Can Actually Run
A realistic employee privacy program for a small business has seven parts, takes a few focused sessions to build, and is mostly one-time setup. It is not a policy binder. It is a map, a set of walls between data categories, a schedule, and two short playbooks.
The sequencing matters. Steps one and two produce most of the risk reduction and can be done in an afternoon. Steps three through five formalize what you did. Steps six and seven are what separate a company that survives an incident from one that improvises through it badly.
Step one has an output, and this is it. Fill the first tab in one sitting with the systems you already know about, then add the ones you find over the following week, because you will find some. The second tab turns the same list into an access review, and the third holds the answers your vendors gave you in writing.
| A | B | C | D | E | F | G | H | I | |
|---|---|---|---|---|---|---|---|---|---|
| 1 | System or location | Who owns it here | Categories of employee data in it | Regulated category it holds | Who can open it | How access is removed | Retention rule that applies | How it gets disposed of | Last reviewed |
| 2 | HR system or employee records | ||||||||
| 3 | Payroll provider | ||||||||
| 4 | Benefits portal or broker | ||||||||
| 5 | Time and attendance system | ||||||||
| 6 | Background screening account | ||||||||
| 7 | Form I-9 file or binder | ||||||||
| 8 | Confidential medical file | ||||||||
| 9 | Shared drive folders | ||||||||
| 10 | Email and message threads | ||||||||
| 11 | Spreadsheets a manager keeps | ||||||||
| 12 | Paper files and cabinets | ||||||||
| 13 | Recruiting inbox and applicant records |
Where the software helps is in collapsing the map. A single system holding employee records with role-based permissions, separate confidential storage, and an audit trail of who opened what removes most of the search problem before it starts. That is the connection between document management and privacy: they are the same project viewed from two angles, and doing one well delivers the other.
Start with the map, then review the whole program once a year, alongside whatever else you check in an HR audit. Privacy obligations change faster than most employment rules, state legislatures keep passing new ones, and a program built two years ago and never revisited is a program that describes a company you no longer are.
Frequently Asked Questions
Do US employers have to comply with data privacy laws for employee data?
Yes, but no single law covers it. The United States has no general employee privacy statute, so an employer’s duties come from several places at once. Federal laws each cover one kind of data: the Americans with Disabilities Act (ADA) for medical information, the Genetic Information Nondiscrimination Act (GINA) for genetic information, and the Fair Credit Reporting Act (FCRA) for reports from screening companies. States layer on breach notification (every state has a law), biometric consent rules in a handful of states, and Social Security number and personnel file rules in many. Vendor contracts add obligations too. In practice no employer is exempt: even a small company must notify affected employees after a breach and dispose of background check data securely, and once headcount reaches 15 the ADA’s separate medical file applies as well.
Does the CCPA apply to employees and job applicants?
Yes. Among the states, only California extends its comprehensive privacy law to workforce data in full. A carve-out that had kept employee, applicant, contractor, director and beneficiary information out of the California Consumer Privacy Act ran out at the end of 2022 and was never extended, so since January 2023 a covered employer owes its California workers the same rights it gives its customers. Those include a notice at or before collection, the rights to know, delete and correct, the right to opt out of sale or sharing, the right to limit use of sensitive personal information, and protection from retaliation. Whether you are covered turns on business thresholds rather than headcount: revenue above the statutory dollar figure, buying, selling or sharing the personal information of 100,000 or more California residents or households, or earning half your revenue from selling or sharing it.
What must an employer do when an employee asks for a copy of their data?
It depends on which law gives the employee the right, so identify that law first. In California, a covered employer has 45 calendar days to answer a verifiable request, can extend once by another 45 days if it tells the employee about the extension within the first 45, and must confirm the requester’s identity before disclosing anything. In other states the employee’s right typically stems from a state personnel file access law instead. That is a narrower right: it reaches the personnel file, sets its own deadline and often allows a copying fee. Whichever law applies, the process is the same. Record the request, verify identity, pause routine deletion of anything responsive, search every system including your payroll and benefits vendors, redact other people’s personal data, and write down why you withheld anything.
Can an employer keep medical information in the personnel file?
No. The ADA requires medical information to live apart from the personnel file. What an employer learns by asking medical questions or requiring an exam goes onto its own forms and into its own medical file, and it is handled as a confidential record under 29 CFR 1630.14. That rule binds every covered employer in every state, whether or not a privacy statute reaches your workforce data. Genetic information, such as a relative’s medical history mentioned in passing, gets the same separation under GINA. Set up a locked cabinet or a restricted folder that the hiring manager cannot open, and put in it doctor’s notes, accommodation paperwork, workers’ compensation records, drug test results and enrollment forms for the health plan. Supervisors get told about work restrictions and accommodations only, never the diagnosis behind them.
Do we need consent before collecting fingerprints for a time clock?
In several states, yes. Consent has to be written and informed, and it has to come before the first scan. Illinois matters most because its Biometric Information Privacy Act lets employees sue directly rather than waiting for a regulator. Under that act you need a published written policy covering how long scans are kept and when they are destroyed, plus a signed release from each person before you collect anything. Texas also requires notice and consent, and Washington covers identifiers enrolled for a commercial purpose, but only the state attorney general can enforce either law. Colorado is a further case: since July 1, 2025, its privacy act has imposed biometric duties on employers, and those duties cover employees although employment data is otherwise exempt from the act. Before turning on a fingerprint or face scan time clock, check which states your staff actually work in.
Who is responsible if our payroll vendor has a data breach?
Legally, you usually are responsible, at least toward your own employees. State breach laws generally put the duty to notify on whoever owns or licenses the data, and the vendor that merely holds it must alert you so you can pass the news on. A breach at your payroll provider therefore becomes your notification project, on your deadline, and the letter goes out under your name. The contract decides who pays. Before signing with any provider that touches employee data, ask for its security documentation, a written breach notice commitment stated in hours, where the data is stored and which subprocessors handle it, and an indemnity that covers notification costs. Also ask what happens to your data when you leave, and get that deletion commitment in writing.
How long should we keep employee personal data?
Keep each record as long as the longest legal retention rule for that record type requires, and no longer. Two bodies of law pull against each other here. Records laws set minimums: hold this document for at least so many years. Privacy law sets a maximum: do not keep personal data once the reason you collected it is gone. Reconcile the two with a written schedule that names each record type, the rule behind it, the retention period and the disposal method, then actually carry out the disposal, because old records you no longer need only add exposure if you are breached. One exception trumps the schedule. If you can reasonably foresee a lawsuit, a charge filed with an agency or an audit, put a legal hold in place and stop destroying anything that might be relevant.
Do we have to tell employees we monitor their email?
In several states you must, in writing, and it is wise to do it everywhere. New York is the clearest example: an employer that monitors phone calls, email or internet use has to give new hires written notice and get their acknowledgment, and repeat violations bring escalating civil penalties. Connecticut and Delaware have notice rules of their own. Federal law is looser. The Electronic Communications Privacy Act permits interception when one party consents and has a business use exception, though a signed consent is far easier to prove than an assumption drawn from a handbook nobody read. So put the policy in the handbook, describe only the monitoring you really do, get a signed acknowledgment during onboarding, and never monitor what you have not disclosed.
Make HR the easy part of running your business
Onboarding, e-signatures, training and core HR in one place. Up and running in 5 minutes.
- 7-day free trial
- No credit card required
- Cancel anytime