Many California employers still follow a two-year retention habit for hiring records. The Civil Rights Council's regulations on automated-decision systems, which took effect on October 1, 2025, changed that. The Council's own announcement says the regulations "Ensure employers and covered entities maintain employment records, including automated-decision data, for a minimum of four years." The California Consumer Privacy Act (CCPA) regulations add separate retention and logging periods. This post sets out each one and ends with a schedule you can adapt.

A Warning About Old Text

Some secondary legal websites still display the earlier two-year version of 2 CCR section 11013. If your retention policy was copied from one of them, it may be out of date. Read the final text on the Civil Rights Council site, which is linked in the sources below, and confirm the current wording with counsel. The Fair Employment and Housing Act applies to employers with five or more employees, so the rule reaches many small organizations.

The Four-Year Rule

Section 11013(c) requires four years of retention and lists "selection criteria, automated-decision system data" among the covered records. The practical point is that the scores and outputs of a screening tool are not scratch work. They are records. For the broader rules, see our overview of the Civil Rights Council regulations.

The regulations do not leave the phrase "automated-decision system data" to guesswork. Section 11008.1(d) defines it as "(1) Any data used in or resulting from the application of an automated-decision system, such as data provided by or about individual applicants or employees, or data reflecting employment decisions or outcomes; and/or (2) Any data used to develop or customize an automated-decision system for use by a particular employer or other covered entity."

The definition of the system itself is broad. Section 11008.1(a) covers "A computational process that makes a decision or facilitates human decision making regarding an employment benefit," and it includes screening resumes for particular terms or patterns. A keyword filter in an applicant tracking system can therefore fall inside the rule.

What the Definition Points To

Read together, the two prongs of section 11008.1(d) suggest that an employer should keep several categories of records. These are our reading, so have counsel confirm them for your tools.

Inputs. The applicant data the tool received, and the job description it compared against.

Outputs. The score, ranking, or recommendation for each person, and the date it was produced.

Outcomes. What the reviewer decided, which is the "data reflecting employment decisions or outcomes."

Configuration. The data used to develop or customize the tool for your organization, such as the criteria you set.

Vendor-held data. Many tools keep scores in the vendor's system, not yours. Ask the vendor how long it keeps scored records, whether you can export them, and what happens to the data when the contract ends, so that your own schedule can be met.

Dates. Store the date each record was created. Without it, nobody can calculate when a four-year period ends.

The Litigation Hold

Section 11013(c)(4) sets a litigation hold, and the hold includes automated-decision system data. Review its text with counsel to identify the events that trigger it. Once a hold applies, routine deletion must stop for the records it covers, even if the ordinary schedule would otherwise allow disposal.

The CCPA Periods

The CCPA regulations add two periods. Under section 7155(c), a risk assessment must be retained for the longer of the duration of the processing or five years. Under section 7101, a business must keep records of consumer requests for 24 months, including the date of the request, its nature, the manner in which it was made, the date and nature of the response, and the basis for any denial. Section 7152(a)(3)(G) calls for documentation of the logic of automated decisionmaking technology and how its output is used, which belongs in the assessment file. Our post on the January 1, 2027 deadline explains when these duties begin, and our post on answering a candidate data request explains the log.

A Retention Schedule

Record Minimum period Source
Employment records, including selection criteria Four years 2 CCR section 11013(c)
Automated-decision system data: inputs, outputs, outcomes, and customization data Four years 2 CCR sections 11008.1(d) and 11013(c)
Records covered by a litigation hold Preserve while the hold applies 2 CCR section 11013(c)(4)
CCPA risk assessment and its supporting documentation The longer of the processing duration or five years 11 CCR sections 7155(c) and 7152(a)(3)(G)
Log of consumer requests and responses 24 months 11 CCR section 7101

When two periods apply to the same record, keep it for the longer one. The regulations summarized here do not tell you when the four-year clock starts for every record type, so ask counsel to fix that date in your policy.

The 24-month request log is the shortest period in the table, and it is easy to mistake for the general rule. It covers the record of the request itself, not the hiring records the request concerns. Those stay on the four-year schedule unless a longer period applies, and counsel can confirm how the two interact for your organization.

Steps for This Quarter

Compare your policy to the current text. Replace any two-year language.

List your tools. For each, note where its inputs, outputs, and settings are stored and who can delete them.

Stop automatic purges. Turn off any vendor setting that deletes scored records sooner than your schedule allows. Our post on what a bias audit should contain explains why test results belong in the same file.

Create the hold procedure. Decide who can order a hold and how the order reaches the system owners.

How TrueScan HR Helps

TrueScan HR scores a resume against the job description and shows the matched and missing skills, along with a narrative assessment that explains each score. The reviewer makes the decision, and TrueScan HR keeps a scored record for each resume, which gives you something concrete to retain. Enterprise plans include certified weekly bias testing and a 4/5ths adverse impact report.

The Bottom Line

The retention rule for California hiring records is four years, and it expressly reaches automated-decision data. Fix the policy, protect the scored records, and keep the longer CCPA periods in view.

This post is general information, not legal advice. TrueScan HR is not a law firm. Confirm how these rules apply to your organization with employment counsel.

Sources: