CCPA vs GDPR for employee data: a side-by-side for US companies

Which regime applies to a US company's employee records?

Most US companies start with California's privacy statute and treat EU rules as an exception for the people and offices that touch Europe. The practical rule many owners use: license the US records first and carve EU and UK records out. That keeps the dataset inside one legal frame and avoids a cross-border analysis for a license that does not need one.

The two regimes are built differently. The California Consumer Privacy Act is a notice, rights and contract regime that applies to for-profit businesses meeting one of three tests. The EU General Data Protection Regulation is a lawful-basis regime: every use of personal data needs a stated legal ground, and a new use usually needs a fresh look. This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

CCPA vs GDPR for workforce data: side-by-side

The table compares how each regime treats the records an employer actually holds: personnel files, mailboxes, chat, timesheets, badge logs and recorded calls.

The CCPA statute text requires notice at collection, says collection and use must be reasonably necessary and proportionate, and requires a written agreement when personal information is sold, shared or passed to a service provider. California regulations were also updated in 2026, so check current text rather than relying on older summaries.

How the "who is covered" tests work in practice

Owners often ask whether they are covered at all. The California Attorney General's overview says the CCPA applies when a business meets any one of three tests: an annual gross revenue threshold that is adjusted over time, buying, selling or sharing the personal information of a large number of California residents or households (the statute sets the figure), or deriving half or more of annual revenue from selling or sharing personal information.

For the EU side, the question is whether the company has an EU establishment or deliberately monitors or serves people in the EU. A US company with no European staff, offices or customers may have little EU workforce data. A US company with a Dublin sales office or remote engineers in Germany does.

The related page on whether the CCPA applies to your business walks through the thresholds. The companion guide on CCPA service provider, contractor and third party roles explains why the label on the recipient matters.

What changes when you license workforce data?

Licensing is a new use. Under both regimes, the question is not only whether you may keep employee records but whether you may hand a copy to a buyer for AI training.

• California: check what the notice at collection and the employee privacy notice said about disclosure. Decide whether the transfer counts as a sale or sharing, and what contract terms the buyer must accept.
• EU and UK: a change of purpose needs a compatibility assessment or a new basis. The purpose limitation guide covers that test.
• Both: a de-identification standard applies only if the company can meet its conditions. See the guide to the three commitments for de-identified data.

FTC staff guidance from February 2024 warns that quietly widening data practices, such as sharing data or AI training, through a retroactive change to terms or privacy policies may be unfair or deceptive. It is staff guidance, not a rule, and it concerns customer data. Employee notices deserve the same read.

The decision rule: license US first, carve EU out

Use this sequence before an inventory is finalized.

1. List every system that holds employee, contractor or applicant records: HR, payroll, email, chat, ticketing, call recording.
2. Mark which people, offices and mailboxes sit in the EU or UK.
3. Exclude those records from the first license by location and domain filters. The guide on carving EU and UK records out of a US data license lists practical filters.
4. For the remaining US records, check the notices, then agree redaction and de-identification rules with SourceX and the company's counsel before any work begins.
5. Revisit EU records only later, with counsel, if the company wants a second license.

Employee personnel files, medical leave records, background checks and compensation data are usually excluded by default. The valuable material is work product: tickets, project threads and decisions, redacted of personal identifiers.

Where this matters to a referral partner

Partners do not handle data or give legal advice. You introduce a company, and SourceX works through qualification, inventory and rights review with the company. What you can do is spot the issue early and ask the sponsor who in the company owns privacy questions.

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is paid only after the buyer pays and SourceX receives its fee, and no reward is guaranteed.

Questions to take to counsel

• Did our employee notice mention disclosure to third parties or use for analytics or AI?
• Which of our staff, contractors and applicants are California residents?
• Do we have EU or UK staff, offices or customers whose records sit in shared systems?
• Can we exclude those records by domain, location or workspace before delivery?
• Who signs for the company if a buyer asks for warranties about notices and rights?

Next step

Run a quick screen with the company fit checker and read how the process works. If you know a US company with 50+ full-time employees at peak (contractors excluded) and years of records, register as a partner and make the introduction.