A former applicant emails your recruiting inbox and asks what information you collected, where it came from, and how it was used. For many California employers, that email is a privacy request with a legal deadline. The California Privacy Protection Agency's FAQ says the California Consumer Privacy Act (CCPA) "includes California residents that are employees or job applicants." Whether your organization is a covered "business" depends on statutory thresholds, so confirm that with counsel. If it is covered, the following steps apply.
The steps below follow the regulations in order. They are written for an in-house recruiting or human resources team, and each can be assigned to a named person.
Step One: Offer Ways to Ask
Section 7020 requires two or more methods for submitting a request, and one of them must be a toll-free telephone number unless the business operates exclusively online. Put the methods on the careers page and in the application confirmation, so a person does not have to guess where to send the request. Route every channel to one owner. A request sent to a hiring manager's personal inbox is still a request.
Step Two: Watch the Deadlines
Section 7021 sets three clocks. The business confirms receipt within 10 business days. It responds within 45 calendar days. If it needs more time, it may extend by another 45 days, up to a maximum of 90, but only with notice to the requester. Calendar all three dates on the day the request arrives, and record which one applies. Late answers are the most avoidable failure in this process.
Step Three: Decide What Period to Cover
Under section 7024(h), a response generally covers the 12 months before the request. The requester may ask for earlier information, and in that case the response goes back to January 1, 2022. Because applicant records follow the retention periods in our recordkeeping post, much of what you hold may be several years old, and the lookback decides how much of it you must produce.
Step Four: Protect What You Must Not Disclose
Section 7024(d) says not to disclose certain sensitive items in the response, among them Social Security numbers, identification numbers, and account numbers. Review each record before it goes out. Resumes and background check files often contain exactly these items, so a bulk export without review is a risk.
Step Five: Explain Any Denial
If you deny all or part of a request, say why. For the automated tool access right described below, section 7222(f) requires an explanation of the basis for a denial, and the same habit is sound across the whole process. A denial should name the part denied and the reason, such as a legal exemption you can cite. Counsel should approve the reason before it is sent.
Step Six: Add the Automated Tool Answer From January 1, 2027
Compliance with the automated decisionmaking technology (ADMT) rules is required no later than January 1, 2027 (section 7200(b)). From then on, a request may include a question about automated tools. Section 7222(b) calls for the purpose of the technology, its logic, and the outcome of the decision. The logic "may include the parameters that generated the output as well as the specific output with respect to the consumer," and the outcome includes whether the output was "the sole factor" in the decision. Section 7222(c) has a trade-secret carve-out, so ask counsel before withholding anything under it.
If the same technology was used on a person more than four times in 12 months, section 7222(j) provides for an aggregate response. Read the provision with counsel before you rely on it. For the detailed list of questions, see what candidates can ask about automated decisions, and for the timeline, see our post on the January 1, 2027 deadline.
Draft a template answer for each tool before any request arrives. Include the purpose in plain language, the categories of information the tool uses, the type of output, where a person reviews it, and how the outcome is described. Counsel can review the template once, which shortens the work inside the 45 day window later.
Step Seven: Log the Request
Section 7101 requires records of requests for 24 months. Each entry should show the date of the request, its nature, the manner in which it was made, the date and nature of the response, and the basis for any denial. A simple spreadsheet works if one person owns it. The log is also your proof that the 10 business day and 45 day clocks were met.
Common Mistakes
Searching only the applicant tracking system. Applicant information also lives in email, interview notes, and screening tools.
Sending a raw export. Unreviewed files can contain the items section 7024(d) says not to disclose.
Missing the confirmation. The 10 business day step is separate from the 45 day response.
Skipping the log. Without it, you cannot show the dates, the response, or the reason for a denial.
A Short Internal Procedure
Day one. Log the request and set the three dates.
By day ten (business days). Send the confirmation of receipt.
Weeks two to five. Collect records from the applicant tracking system, email, and any screening tool. Remove the items that must not be disclosed. Draft the automated tool answer, if applicable.
Before day 45. Send the response, or send notice of extension with the reason.
After. Complete the log entry and file the response.
How TrueScan HR Helps
TrueScan HR scores a resume against the job description and shows the matched and missing skills, along with a narrative assessment that explains each score, which gives you language for describing what the tool did. The reviewer makes the decision, and TrueScan HR keeps a scored record for each resume so the record can be located when a request arrives. Enterprise plans include certified weekly bias testing and a 4/5ths adverse impact report.
The Bottom Line
An applicant request is a deadline-driven process with a defined method, lookback, limits on disclosure, and a log. Set up the owner and the procedure now, and the January 1, 2027 automated tool answer becomes one more step instead of a scramble.
This post is general information, not legal advice. TrueScan HR is not a law firm. Confirm how these rules apply to your organization with employment counsel.
Sources: