California employers face new compliance obligations under the CCPA requiring detailed risk assessments for routine HR data processing activities. From GPS tracking of fleet drivers to AI-assisted employment decisions, companies must now document and evaluate privacy risks across six specific processing categories. This analysis outlines a seven-step framework to help covered employers navigate these requirements and prepare for the January 2026 effective date.
Does your company track the GPS location of fleet drivers, use AI to assist with employment decisions, or analyze racial data as part of an equity program?
If so, or if your company conducts a broad range of other forms of data processing in California, your company may need to conduct a detailed, documented risk assessment to comply with the California Consumer Privacy Act, or CCPA.
Since 2023, the CCPA has required most California for profit employers to implement a comprehensive privacy program to protect HR data. Effective January 1, 2026, the CCPA regulations added a new requirement: covered employers must complete risk assessments for many routine data processing practices.
Against that backdrop, covered employers might consider taking these seven steps to prepare.
First, determine whether any uses of California HR data fall within one of the CCPA’s six processing categories subject to a risk assessment.
Second, ...
“Let me lay out the facts: Donald Trump lost the 2020 election. Period. Despite his false claims, there is no evidence of any widespread voter fraud in that election and we heard nothing new today...