Payroll Data Privacy in 2026: A Small-Employer Guide to California, Colorado, and Virginia

If you employ even one person who lives in California, the W-4 on file, the direct-deposit routing number, and the hours you track each pay period are not just payroll records anymore. Since January 1, 2023 they have been that person's personal information under state privacy law, with the same rights to know, delete, and correct it as any consumer browsing your website. And while Colorado and Virginia took a different path, new 2025 and 2026 amendments mean you can't rely on an "employee exemption" to ignore payroll privacy anywhere — especially if you use fingerprint time clocks, AI hiring tools, or a cloud payroll provider.

The good news: the fix is not a bespoke legal project for each state. It is a short set of habits — a clear notice, a data map, a retention schedule, honest vendor contracts, and a response plan — that satisfy the strictest state (California) and get you 90% of the way everywhere else.

Why Payroll Data Became "Personal Information"​

For years, the nation's first comprehensive privacy law, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), included a temporary carve-out for workforce data. Employers only had to give a privacy notice and keep data reasonably secure.

That exemption sunset on December 31, 2022. It was not renewed. On January 1, 2023, California employees, job applicants, independent contractors, and even emergency contacts and benefits beneficiaries became full "consumers" for privacy purposes.

Two other early comprehensive laws took the opposite approach. The Virginia Consumer Data Protection Act (VCDPA), effective January 1, 2023, and the Colorado Privacy Act (CPA), effective July 1, 2023, both define "consumer" as a resident acting only in an individual or household context — explicitly excluding anyone acting in a commercial or employment context. Under that definition, ordinary HR and payroll files are outside the CPA and VCDPA.

So why does your TODO still say to treat payroll data as protected in all three states? Because the patchwork has moved.

• California's 2026 regulations raise the bar again (more below).
• Colorado, as of July 1, 2025, carved biometric identifiers back into its law for employees and applicants — fingerprint, face, voice, eye scans collected with a time clock or security badge now trigger CPA duties even though the rest of the payroll file does not.
• In Colorado, separate 2026 AI rules now impose notice and human-review duties when automated decision-making tools materially influence hiring, pay, promotion, or termination — rights the CPA itself does not give employees.
• Virginia has not brought general employment data back into the VCDPA, but its 2026 legislative surge — pay transparency, Human Rights Act expansion to employers with five workers, and new payroll-processor licensing — shows the same direction: workforce information is being treated as sensitive and regulated.

By mid-2026, about 20 states have comprehensive consumer privacy laws in effect or signed, most following the Virginia/Colorado household-context model. California remains the only one that fully covers the employment relationship. If you operate in one or more of these states — or have remote employees who do — the safest and simplest posture is to handle payroll data everywhere as if it were in scope.

The Three-State Reality Check​

California: Fully Covered, and More Demanding in 2026​

Who is covered? You are a "business" subject to the CCPA/CPRA if you do business in California and meet any one of these 2024-adjusted thresholds: annual gross revenue over $25 million; you handle the personal information of 100,000 or more California residents or households in a year; or you derive 50% or more of annual revenue from selling or sharing personal information. Service providers and contractors that process data on your behalf have their own duties.

If you have a single California resident on payroll, their data counts toward that 100,000-resident threshold alongside your customers and website visitors. Many small businesses with a modest customer list cross the threshold precisely because workforce records push them over.

What rights do workers have? The same as consumers:

• Right to know what you collected, your sources, purposes, and with whom you shared it
• Right to delete, subject to legal-retention exceptions (tax, wage, and benefit records you must keep)
• Right to correct inaccurate information
• Right to opt out of the sale or sharing of personal information and to limit the use of Sensitive Personal Information
• Right to non-discrimination for exercising these rights

What counts as Sensitive Personal Information? Payroll ticks almost every box: Social Security numbers, driver's license or passport numbers, financial account + login credentials, precise geolocation (company phone or fleet GPS), racial or ethnic origin, and biometric data.

What is new on January 1, 2026? On September 23, 2025, the California Privacy Protection Agency won final approval for its update to the CCPA regulations. The core changes take effect January 1, 2026, with staggered compliance deadlines:

• Risk assessments for high-risk processing — including any use of Sensitive Personal Information, selling/sharing, or automated decision-making — are required starting January 1, 2026, with documentation to be made available to the CPPA on request and formal submission by April 1, 2028.
• Automated decision-making technology (ADMT) rules, with rights to notice, opt-out, and explanation, take effect January 1, 2027.
• Annual cybersecurity audits by an independent professional are required on a revenue-based schedule: certification by April 1, 2028 for businesses over $100 million, April 1, 2029 for $50–$100 million, and April 1, 2030 for under $50 million.

For a small employer that uses an AI résumé screener, a productivity score, or a dynamic pay tool — even through a vendor — these are no longer future concerns.

Enforcement: The California Attorney General and the CPPA can bring civil actions. Intentional violations under the CCPA reach $7,500 per violation; unintentional violations are $2,500 each, with a 30-day cure period no longer guaranteed. Employees also have a limited private right of action for data breaches caused by a failure to implement reasonable security.

Colorado and Virginia: Exempt, But Not the Way You Think​

The baseline exemption is broad. Under both the CPA and VCDPA, an employee clocking in or a contractor submitting an invoice is not a "consumer." You do not owe them the full CCPA-style rights to know/delete/opt out for ordinary payroll facts.

This surprises owners who assume every state mirrors California. It is why national checklists that say "VCDPA and CPA do not apply to HR data" were technically correct in 2023–2024.

The exception that matters in Colorado: House Bill 1130, the Biometric Amendment, effective July 1, 2025, overrides the exemption in one high-risk area. If you collect biometric identifiers from employees or applicants — fingerprint or hand scan for a time clock, facial scan for building access, voiceprint for phone authentication — you are now a "controller" of that data under the CPA, even for workers.

You must then:

• Adopt and publish a written biometric retention and destruction schedule
• Obtain consent before collection, except for narrow security-access purposes defined by statute
• Use biometrics only for the disclosed purpose, keep it no longer than necessary, and delete it on a defined schedule
• Guard it with reasonable security and have a written incident-response plan
• Be ready to produce documentation to the Attorney General or district attorneys, who enforce the amendment (no private right of action)

The definition of employee is broad — full-time, part-time, on-call, contractors, subcontractors, interns, fellows — so a construction subcontractor's fingerprint on your site tablet counts.

Colorado's separate artificial-intelligence law, as re-adopted in May 2026, goes further. An employer using a covered ADMT to materially influence a consequential employment decision must give advance notice, and after an adverse action offer the worker a chance to correct inaccurate personal data and obtain human review. Those duties exist even though the CPA itself still excludes general employment records.

Virginia remains employment-exempt for general data, but two 2026 trends close the practical gap:

1. The threshold for being a covered employer shrank elsewhere. Virginia's Human Rights Act now applies to employers with five or more employees as of July 1, 2026, and its pay-transparency law requires salary ranges in postings. Companies updating handbooks for those laws are finding their HR files subject to closer scrutiny anyway.
2. Federal absence fuels state action. With no comprehensive federal privacy law, Virginia's model — 100,000 residents or 25,000 if you sell data, plus data-protection assessments for targeted advertising, data sales, profiling, and Sensitive Data processing — leaves most very small employers outside the VCDPA. But if you are over threshold for customer data, auditors and customers increasingly expect you to apply the same hygiene to employee data.

Practical takeaway: do not market a "Virginia employees have no privacy rights" policy. The statute says ordinary payroll files are not consumer personal data under the VCDPA, but a Virginia resident's Social Security number on a W-2 is still Sensitive Data under your breach-notification duty, and your payroll processor's contract still needs the same protections you build for California workers.

The Patchwork You Actually Have to Track​

As of 2026, comprehensive laws with varied thresholds, Sensitive Data definitions, and rights are in effect or signed in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Delaware, Montana, Iowa, Indiana, Tennessee, Florida, and others. Key variables:

• Thresholds: 100,000 consumers is common (Virginia, Colorado, many followers), but California uses 100,000 residents/households and Texas uses either 100,000 or 25,000 if you sell data. A small e-commerce brand with a large customer list can be in scope even with five employees.
• Sensitive Data: Always includes Social Security number, precise geolocation, biometric, health, and minor's data, but some states add additional categories.
• Rights and appeals: All give rights to know/access, correct, delete, and opt out of targeted advertising/sale. Most require an appeals process and a response within 45 days (with one 45-day extension).
• Assessments: Most require data-protection assessments for high-risk processing before you start it, and to produce them on the Attorney General's request within 30 days.
• Enforcement: Almost all are AG-only, with cure periods that are shrinking or disappearing. California's agency enforcement is the most active, and its 2026 AG investigative sweeps have specifically targeted employers' workforce notices.

You do not need 20 privacy programs. You need one defensible program pitched to the strictest requirements among the states where your people live.

What Counts as Payroll Personal Information​

Map it once and you will see why regulators worry:

• Core identifiers: Name, alias, Social Security number, driver's license or state ID, passport, date of birth, personal email and phone, home address
• Financial: Bank account and routing number for direct deposit, payroll card numbers, wage rate, hours worked, deductions, garnishments, 401(k) elections, stock or option grants
• Sensitive HR: Race, ethnicity, or national origin you collect for EEO-1 or affirmative action; citizenship or work-authorization documents; disability or accommodation notes; leave and workers' compensation records
• Security and surveillance: Username + password for HRIS, badge access logs, CCTV stills, fingerprint or facial scan for time clocks, voice recordings from service centers
• Performance: Reviews, disciplinary notes, investigations, monitoring of company devices or vehicles

Every category above is either "personal information" everywhere or "Sensitive Personal Information" in California. A spreadsheet with names and net pay is therefore not a low-risk file — it is a ledger of Sensitive Data.

The Core Employer Obligations You Can't Ignore​

1. Give a Workforce Privacy Notice at Collection​

California requires an upfront notice that states:

• Categories of personal information you collect and the purposes for each
• How long you keep each category (or the criteria you use)
• Whether you sell or share it, and the categories of third parties
• Your retention and security practices and the rights the individual can exercise

Do this even if you believe you are below the CCPA threshold. The notice itself is low cost, it satisfies California workers, and it doubles as the transparency document every state Attorney General now asks for first. Post it in your HR portal, include it in offer letters, and hand it to every new hire alongside the W-4.

2. Minimize, Then Document Why You Keep What You Keep​

Privacy law says: collect only what you need for a disclosed purpose, keep it no longer than necessary. Tax and wage law says: keep it for years. Both are true — you bridge them with a written retention schedule.

• Payroll and time records: 3 years under federal FLSA and many state wage laws; keep the underlying hour and pay calculations, not just the final paystub.
• Tax records (W-4, W-2, state withholdings, unemployment filings): 4 years after the tax becomes due, per IRS (and up to 7 years if you want to defend a bad-debt or worthless-security position — the "3-4-6-7" framework).
• Benefits and Forms 5500, COBRA, FMLA: 6 to 8 years is common counsel.
• Application and résumé files for non-hires: 1 year (3 years for federal contractors) under EEOC.
• Biometric templates: Colorado requires deletion when the initial purpose is satisfied or within an explicit schedule you publish — often 30 days after employment ends unless a pending dispute requires longer.
• Security logs and access reviews: Align with your cybersecurity-audit cycle, generally retaining at least 12 months of access logs for the audit.

Write the schedule, publish the timeframes in your notice, and assign owners for deletion. A reminder that "we delete biometric templates 30 days after termination unless a wage claim is pending" is worth more than a generic "we keep data as long as needed."

3. Treat Security as a Reasonableness Standard You Can Show​

The CCPA's private right of action for breaches pivots on whether you implemented "reasonable security procedures and practices." The 2026 cybersecurity-audit regulations give that phrase teeth:

• Encrypt Social Security numbers and bank accounts at rest and in transit, including exports to Excel and backups
• Enforce multi-factor authentication for your HRIS, payroll, and file-share where that data lives
• Role-limit access: payroll administrators see bank accounts; managers see time approvals, not SSNs; IT sees logs, not content
• Log and review access monthly — who viewed or exported payroll, who changed direct-deposit details
• Have a tested incident-response plan that covers HR data, not just customer data, with a 30-day assessment-production workflow
• Keep your audit trail for five years

You do not need an enterprise SOC team to meet the small-business reasonableness test. You do need MFA, encryption, least-privilege access, and a written plan you actually drill once a year.

4. Build a Simple Rights-Request Workflow​

Even if you are exempt in Virginia or Colorado, run the same single workflow for any worker in any state:

• A single inbox (privacy@ or hr-privacy@) and a web or paper form that captures identity verification without collecting more sensitive data
• A verification step proportionate to risk (for payroll data, verify identity before disclosing an SSN — never email a full SSN unencrypted)
• A 45-day clock with a documented 45-day extension if needed
• A cross-check for legal holds that prevent deletion: open wage claims, litigation holds, tax-retention periods, or payroll-vendor final filings

Do a tabletop once: a former employee asks to delete "everything you have on me." Your answer is not a flat yes or no — it is a letter listing what you deleted, what you retained and why (citing retention statute and purpose), and how they can appeal.

5. Fix Your Vendor Contracts Before the Breach​

Your payroll provider (whether ADP, Gusto, QuickBooks Workforce, or a PEO) is your service provider or processor for privacy purposes. Every comprehensive law requires a written contract that:

• Limits the vendor to using personal information only to provide the payroll service
• Prohibits selling or sharing it and requires confidentiality of anyone who touches it
• Obligates the vendor to help you answer rights requests and to delete or return data at termination
• Requires reasonable security, breach notice without undue delay (and within a negotiated SLA, often 24 to 72 hours), and cooperation with assessments

Check two clauses in particular in 2026: auto-filing and data-broker status. QuickBooks Workforce, for example, now auto-files certain payroll tax forms as of July 1, 2026 — you lose a manual-approval choke point and gain a reliance on the vendor's security and accuracy. Ensure the DPA covers that filing path. And if your vendor monetizes de-identified compensation benchmarks, confirm whether your state treats that as a "sale" or "sharing" and whether you need an opt-out mechanism.

6. Run a Privacy Risk Assessment Before High-Risk Moves​

Under California's 2026 rules and common across the patchwork, you must assess before you:

• Roll out a new biometric time clock or continuous productivity monitor
• Feed applicant data through an AI screening or scoring tool
• Start selling pay-insights to a benchmarking cooperative or letting a benefits-broker resell data
• Launch an employee-monitoring pilot that tracks keystrokes, location, or chat sentiment

The assessment need not be 40 pages for a ten-person shop. One page per initiative — purpose, data categories, necessity, risks to workers, safeguards, and residual risk — kept on file and produced within 30 days if the AG asks, satisfies the form. Doing it before procurement keeps you from buying a tool whose data practices you cannot defend later.

A Practical 30-Day Checklist for Small Employers​

Use this as a working list with your bookkeeper, payroll admin, and IT generalist. It is pitched to California's ceiling so it covers you elsewhere.

Week 1 — Know what you have

• List every place payroll and HR information lives: HRIS, payroll platform, time-tracking app, benefits portal, file shares, local spreadsheets, email, paper personnel files, and the laptops of anyone who exports data
• Draft a data-flow map: categories of data → purpose → system → who has access → third-party recipients
• Inventory which employees and contractors live in which states

Week 2 — Tell people honestly

• Publish or refresh your workforce privacy notice (English plus any language spoken by 10% or more of your workforce is good practice)
• Add the notice to the onboarding packet and your intranet
• Document your retention schedule with specific timeframes and the law that drives each

Week 3 — Tighten controls

• Turn on MFA and encryption for every system that touches SSNs or bank accounts
• Trim access to least-privilege — audit one HRIS permission group per week until clean
• Sign or update DPAs with your payroll, benefits, background-check, and recruiting vendors; confirm breach-notification SLAs and deletion-on-exit clauses

Week 4 — Prepare to respond

• Stand up the single rights-request intake form and 45-day tracking log
• Write a one-page incident-response addendum for HR data, with call tree and customer/employee notification templates
• Run a tabletop deletion request and a mock lost-laptop breach; fix what you find

Ongoing

• Quarterly: review access logs, test your ability to produce a data map and risk assessment within 30 days
• Annually: refresh the cybersecurity audit self-assessment, re-certify vendor DPAs, and train managers on "no retaliation" for privacy requests

You do not need to finish everything in a month to make progress. Completing the data map, notice, MFA, and vendor DPA in 30 days already puts you ahead of most sub-100-employee employers swept up in AG reviews.

Three Hot Spots That Trip Up Small Businesses in 2026​

Fingerprint Time Clocks​

A $3,000 time clock with a fingerprint reader feels like a reliability upgrade — no buddy-punching, no lost cards. It is also biometric data: highly sensitive, immutable, and now regulated separately from the payroll numbers around it.

Colorado's biometric amendment is the clearest signal, but Illinois' Biometric Information Privacy Act and its copycats inspired the Colorado language and still expose private rights of action. If you use biometrics anywhere:

• Offer a non-biometric alternative and document consent (or a narrow security-justified exception if your statute allows it)
• Publish the written retention and destruction schedule before you enroll the first finger
• Retain templates only on the device or encrypted store, not in the payroll export spreadsheet

If you can achieve reliable timekeeping with badge + PIN, you eliminate an entire regulated category.

AI in Hiring, Scheduling, and Pay​

An AI screener that parses résumés, a scheduling optimizer that predicts who will call out, or a pay-budget tool that recommends raises all count as ADMT under the 2026 California regulations. Even if you are a small user of a large vendor's product, you are the business that deploys it.

Before renewal, ask your vendor for: the logic in plain English, training-data bias testing, accuracy in your context, and how a worker can contest an outcome. Put that documentation in your risk assessment file. California will expect it; Colorado's AI Act will too; and a good-faith assessment is the best evidence that an adverse pay decision was not arbitrary.

Your Payroll Provider Is Your Biggest Concentration Risk​

Whether you run Intuit, ADP, Gusto, Rippling, or a local CPA's bulk filing, that provider holds every SSN, every bank account, and every net-pay amount for every worker. The 2024 MoveIT breaches taught small employers that a vendor breach is their notification duty to workers.

Confirm in writing: does the vendor retain data under its own privacy policy after you churn? For how long? Can you demand deletion or return? Who is the sub-processor list and how are you notified of changes? And because many providers now bundle benchmarking or "industry insights," confirm whether your configuration opts your data out of any de-identified-sale program.

Where Bookkeeping Meets Privacy — And Where to Get the Separation Right​

Bookkeeping and privacy pull in opposite directions, and a good chart of accounts plus file discipline reconciles them.

Privacy says: do not keep personal information longer than necessary. Accounting and tax law says: keep payroll registers, W-2/W-4 copies, time records, and benefit deduction reports for 3 to 8 years depending on the record type. The answer is not to pick one. It is to keep accounting records at the summarized level you need and personal identifiers only where you need them.

Practical bookkeeping habits:

• Separate systems of record. Keep your general ledger and payroll register with employee-ID or payroll-ID as the key; keep the SSN-to-name crosswalk in the HRIS, not in the accounting export that gets emailed monthly.
• Lock the export. When you journal payroll from the payroll platform to the general ledger, export amounts and accounts without SSNs, and restrict who can run a detailed SSN-inclusive report.
• Name your files honestly. "Payroll-2026-01-Report-ID-only.xlsx" tells a future acquirer or auditor that you minimized by design; "Payroll-everything.xlsx" invites a scope expansion when a rights request or breach assessment lands.
• Build retention into closing. Add a year-end checklist step: archive the payroll detail to encrypted, access-logged storage, purge local downloads, and note the deletion date in your retention log.

You will not eliminate retention conflicts, but you will turn them from "we keep everything forever because accounting said so" into "we keep this payroll register for four years because IRS Revenue Procedure and CCPA retention-disclosure say so, and we delete the biometric template 30 days after exit because Colorado says so."

Keep Your Payroll Privacy and Your Books Aligned From Day One​

Treating payroll data as protected personal information is no longer just a California concern — it is the practical floor for employing anyone across the growing state privacy patchwork in 2026. The same diligence that makes your financial records trustworthy — a clear map of where data lives, a retention schedule you actually follow, and access controls you can demonstrate — is what California's 2026 risk-assessment and cybersecurity-audit rules now ask you to show.

Beancount.io gives you that foundation on the finance side: plain-text, version-controlled accounting that is fully transparent, auditable, and AI-ready — no black boxes, no lock-in, and a complete history of every change to your books. Pair that discipline with a simple workforce privacy notice and a vendor contract you have actually read, and you are ready for whatever the next state amendments add.

Get started for free and see why developers and finance professionals are switching to plain-text accounting.