CCPA for B2B: Are Employee and Vendor Data Exemptions Still Alive?

Remember when CCPA felt like a distant headache for B2B companies? You could almost hear the collective sigh of relief when the original law carved out exemptions for employee and business-to-business (B2B) data. Well, grab your coffee—and maybe a stress ball—because those exemptions are on life support.

What's Changing Under CPRA?

The California Privacy Rights Act (CPRA), effective January 1, 2023, sunsets the temporary exemptions for employee and B2B data. That means if you're a B2B company handling employee or vendor information, you're now squarely in the crosshairs of California's privacy regime.

Featured Snippet Bait: Under CPRA, the temporary exemptions for employee and B2B data expire, meaning businesses must treat that data like any other consumer personal information—with full rights to access, delete, and opt-out.

The Employee Exemption: Gone

Previously, CCPA exempted employee data (HR records, payroll, etc.) from most requirements. Now? Employees have the same rights as consumers: they can request access to their data, ask for deletion, and even opt out of sales (though sales of employee data are rare).

Think of it like this: your HR department just became a mini privacy compliance center. Fun, right? It's like cleaning out your garage, except the garage is full of sensitive personal information and the neighbors (regulators) are watching.

The B2B Exemption: Also Gone

The B2B exemption shielded data collected from business contacts (e.g., vendors, contractors, corporate clients). No more. Now, if you collect a vendor's email or a client's phone number, that data is subject to CCPA/CPRA.

This means your sales team's CRM just got a lot more interesting. Every cold email list, every vendor contact form—all now require compliance. It's like finding out your favorite pair of jeans no longer fits: uncomfortable, but you have to deal with it.

What You Need to Do Now

First, don't panic. But do act. Here's a quick checklist:

Update your privacy policy to include employee and B2B data.
Implement processes for handling data subject requests from employees and business contacts.
Review your contracts with vendors and clients to ensure they comply.
Train your HR and sales teams on the new rules.

For the official text, check out the California Attorney General's CCPA page.

FAQ

Are employee data exemptions completely gone under CPRA?

Yes, the temporary exemption for employee data expired on January 1, 2023. Employees now have full CCPA rights regarding their personal information collected by employers.

Does the B2B exemption still apply to contracts signed before 2023?

No, the exemption expired regardless of when the contract was signed. All B2B data collected or maintained after January 1, 2023, is subject to CPRA.

What are the penalties for non-compliance with employee/B2B data?

Penalties are the same as for consumer data: up to $2,500 per unintentional violation and $7,500 per intentional violation, plus private rights of action for data breaches.