Employee privacy notice template for California employers, clause by clause
A California employee privacy notice tells applicants, employees and contractors, at or before collection, which categories of personal information the company collects, why, whether it is sold or shared, and how long each category is kept. The outline below gives counsel starting text for each clause, including how de-identified business records may be licensed.
When does a California employer need an employee privacy notice?
A business covered by the California Consumer Privacy Act must tell job applicants, employees and contractors who live in California what it collects about them, at or before the point of collection. Section 1798.100 of the statute requires the notice to state the categories of personal information, the purposes, whether the information is sold or shared, and how long each category is retained, and it requires collection and use to be reasonably necessary and proportionate.
Workforce data is not a side issue. Employers should not assume HR records sit outside the framework; ask counsel how the statute applies to applicants, employees and contractors who are California residents today.
Coverage depends on thresholds. The California Privacy Protection Agency's FAQ lists gross annual revenue of $26,625,000 or more in the preceding calendar year, as adjusted from January 1, 2025, as one of three tests; the other two turn on the volume of personal information handled and the share of revenue earned from selling or sharing it. The figure is adjusted periodically, so check the current page.
This is general information, not legal, tax or financial advice. Confirm with your own counsel, tax adviser or professional body before acting.
Why refresh the notice before a data licensing conversation
A notice speaks to the future. Workforce notices written around payroll and benefits often say nothing about analytics, AI tools or de-identified business records. If the company may one day license de-identified workplace records, telling employees now is far better than explaining later.
An updated notice does not reach back over records gathered under the old version. Earlier records are judged against what employees were told at the time, which is one reason SourceX settles de-identification and redaction requirements with the company before any work begins.
The template: a clause-by-clause outline for counsel
Use these clauses as a first draft. Replace every {placeholder}, cut what does not apply and have California employment and privacy counsel finalize the text.
Clause 1: Who the notice covers
Clause 2: Categories we collect
Clause 3: Purposes
Clause 4: De-identified business records
Clause 5: Selling and sharing
Clause 6: Retention
Clause 7: Your rights and how to contact us
How to personalize each placeholder
| Placeholder | What to put in | Who usually supplies it |
|---|---|---|
| {legal_entity_names} | Every entity that employs or engages California residents | Finance or legal |
| {identifier_examples} | Fields actually captured in the HRIS and applicant tracking system | HR operations |
| {employment_examples} | Titles, performance records, training, time and attendance | HR |
| Systems listed in Clause 2 | Every system on the company's data map, including call and meeting recording tools | IT |
| {sensitive_categories} | Only what you truly collect, for example Social Security numbers for payroll or health details for leave | Payroll and benefits |
| Clause 4 | Keep it only if analytics or licensing of de-identified records is realistic | Owner and counsel |
| {retention_table_by_category} | The records retention schedule, checked against what systems really hold | Legal and IT |
The guide to data mapping for privacy compliance shows how to build the system list that feeds Clause 2 and the retention table. If the company captures screens or keystrokes, say so plainly; the guide on keystroke and screen monitoring covers the checks.
When to issue the notice and when to refresh it
| Moment | What to do |
|---|---|
| Before the application form | Link the applicant version on the careers page and in the applicant tracking system |
| Onboarding | Include the employee version in the offer packet and collect an acknowledgment |
| A new purpose, such as licensing de-identified records | Update the notice before relying on the new purpose and announce the change |
| A new system: HRIS, call recording, monitoring or AI assistant | Add the categories it collects before go-live |
| Annual handbook review | Compare the categories against the current data map |
| Before a licensing scope is agreed | Give counsel every past version of the notice with its dates |
Pair the notice with the company's electronic communications policy, which sets ownership and monitoring rules for the same systems.
What never to put in the notice
- Absolute promises, such as never sharing any data in any form, which can block legitimate de-identified uses later.
- Statements that reading or signing the notice is consent to AI training. A notice informs; whether consent is needed is a separate question for counsel.
- Names of prospective licensees, expected payments or anything about referral arrangements.
- Real examples drawn from employee files.
- Catch-all purposes such as any lawful business purpose, which defeat the point of a notice.
Where a referral partner can help
Stale notices are common and fixable, and they are not a reason to drop an introduction. A partner can tell an owner that redaction and de-identification rules are fixed before any records move, point them to how company data is anonymized before licensing, and leave the drafting to counsel. Partners never draft notices, review employee files or handle records.
For a first, non-binding screen of whether a company is worth introducing, use the company fit checker.
Next step
If an owner you advise is refreshing workforce notices and holds years of business records, register as a partner and introduce them, or have them apply at sourcex.si/apply. The how it works page explains each stage they will see.
- Step 1Share your linkSend your personal link to a company you know.
- Step 2Company appliesThe company applies itself at /apply.
- Step 3Buyer selects and paysThe buyer selects and pays for the data and SourceX receives its fee.
- Step 4You get your rewardYour share of SourceX fees becomes payable.
Common questions
Is a notice at collection the same as an employee privacy policy?
Not quite. A notice at collection is the short statement given at or before the point information is gathered, listing categories, purposes, sale or sharing and retention. A privacy policy is the fuller document describing practices and rights. Many employers combine them in one workforce privacy notice and link it from the careers page, the onboarding packet and the intranet.
Does the notice have to cover former employees and contractors?
Coverage generally turns on California residency and the business's status under the CCPA rather than job title; counsel should confirm for each group. Former employees whose records you still hold, independent contractors and applicants who were never hired can all be within scope. Many employers write one notice with short sections for applicants, current staff and contractors, so each group can see what applies to them.
Do we need employee consent before licensing de-identified records?
A notice is not the same as consent, and whether consent is needed depends on the records, how they were de-identified, what earlier notices and policies said, and state law. Counsel should decide. In a SourceX process the de-identification and redaction requirements are agreed with the company before any work begins, and nothing is delivered without an executed agreement.
Can an updated notice cover records collected in earlier years?
Generally no. A notice describes what will happen going forward, so earlier records are assessed against the version in force when they were collected. That is why counsel should keep every dated version. Older records can still be considered for a license, typically after de-identification under rules agreed in advance, but the old notices shape what is in scope.
What if the company falls below the CCPA thresholds?
Then the statute's notice duty may not apply, but a clear workforce notice is still good practice, and other state laws, contracts or sector rules may require one. If the company might license de-identified business records, telling employees about that use in advance builds trust and simplifies any later review. Check the thresholds against current CPPA figures each year.
Related pages
- Data mapping for privacy compliance that doubles as data licensing prep
- Is employee keystroke and screen monitoring legal, and can captures be licensed?
- Electronic communications policy template: clauses to adopt before licensing
- How is company data anonymized before AI licensing?
- Check Company Fit for Data Licensing
- How SourceX US company data referrals work
Free resources
- Operational data inventory builder — List systems, record types, years held and owners.
- AI readiness assessment — Ten questions, five dimensions, a score out of 100.
- EBITDA calculator — Reported and adjusted EBITDA from net income.
- All free tools · MCP resource center
By SourceX Partnerships Team · Published 2026-10-09 · Updated 2026-10-09
Know a US company with valuable proprietary data?
Become a referral partner from anywhere we support, get your link and introduce an owner or authorized decision-maker.
Refer a company →I own a business
Explore licensing your company's data to AI developers worldwide. Start a short assessment; no uploads needed.
Start an assessment