--- title: "CCPA and employee surveys - compliance guide | Sparkbay" description: "What the California Consumer Privacy Act, as amended by the CPRA, requires when you survey employees in California, and how Sparkbay helps you meet each obligation." url: "https://sparkbay.com/en/ccpa-compliance" language: "en" --- Compliance # Employee surveys and the CCPA ## Since January 1, 2023, California's privacy law covers employee data. What it requires when you survey your employees, and how Sparkbay helps you meet it. - ISO/IEC 27001 certified - Personal information never sold - Results by group, never by person [Schedule a demo](https://sparkbay.com/en/request-demo) [Talk to our team](https://sparkbay.com/en/contact-form) ![A Sparkbay survey question as employees see it, with a five-point answer scale](https://sparkbay.com/content/images/feature-survey-bg.png) [Who it covers](https://sparkbay.com/en/ccpa-compliance#scope) · [Obligations](https://sparkbay.com/en/ccpa-compliance#obligations) · [Employee rights](https://sparkbay.com/en/ccpa-compliance#rights) · [How Sparkbay helps](https://sparkbay.com/en/ccpa-compliance#sparkbay) · [FAQ](https://sparkbay.com/en/ccpa-compliance#faq) Who it covers ## When the CCPA applies to your employee survey ### Since January 1, 2023, employees, job applicants and contractors in California have the same privacy rights as any other consumer. Your business A for-profit business that does business in California and has more than $25 million in annual gross revenue, adjusted for inflation, or that meets one of the law's data thresholds. Your people in California Employees, job applicants, contractors, owners and directors who are California residents. Other states Most other state comprehensive privacy laws, such as Virginia's and Colorado's, exclude information about people acting in an employment context. Obligations ## What the CCPA requires for an employee survey ### A survey collects personal information, and sometimes sensitive personal information. ### Give a notice at collection At or before collection, tell employees which categories of personal information the survey collects, why, whether you sell or share them, and how long you keep each category. ### Collect only what is necessary Collecting, using and keeping personal information must be reasonably necessary and proportionate to the purposes you disclosed. ### Take care with sensitive information Questions about racial or ethnic origin, religion, union membership, health or sexual orientation collect sensitive personal information, which the law protects further. ### Bind your providers by contract A provider that processes personal information for you needs a contract that limits its use of the information to the services it provides you. ### Keep it secure Maintain reasonable security. When a breach exposes certain unencrypted personal information because security was not reasonable, the people affected can sue. ### Keep it only as long as needed Keep each category of personal information no longer than reasonably necessary for the purpose you disclosed. Employee rights ## The rights your employees can exercise ### Your business receives these requests and answers them. ### Right to know Employees can ask what personal information you hold about them, where it came from and why you use it, and get a copy. ### Right to delete Employees can ask you to delete personal information you collected from them, with exceptions, such as information you must keep by law. ### Right to correct Employees can ask you to correct inaccurate personal information. ### Right to opt out Employees can opt out of the sale of their personal information, and of its sharing for targeted advertising. ### Right to limit Employees can ask you to limit the use of their sensitive personal information to what the law allows. ### No retaliation You cannot retaliate against an employee, a job applicant or a contractor for exercising these rights. [Schedule a demo](https://sparkbay.com/en/request-demo) How Sparkbay helps ## How Sparkbay helps you meet each obligation ### Confidentiality and security built into the platform, and commitments in our contract ### Built into the platform - **A minimum for every score.** Scores appear only for groups that reach your anonymity minimum, 5 respondents by default and set per organization. - **Comments without names.** Comments appear without names, and only when enough different people have commented to reach your anonymity minimum. - **Same thresholds in exports.** PowerPoint decks and printable reports apply the same thresholds as the dashboard. - **Encrypted and protected.** Employee personal data is pseudonymized, encrypted in transit and at rest, and access is role-based. - **Access you control.** You decide who sees what. Managers can be limited to their own teams, and you choose who sees the whole organization. Access can follow your org chart automatically and be adjusted by hand. - **Activity log.** Your administrators can review an activity log of key actions taken in your account. ### Our commitments - **ISO/IEC 27001.** Sparkbay's information security management system is certified to ISO/IEC 27001:2022 and audited by an independent certification body. - **Hosting.** Your data is hosted on Microsoft Azure, in Quebec. - **Hosting.** Your data is hosted on Microsoft Azure, in Canada. - **Hosting.** Your data is hosted on Microsoft Azure, in Europe. - **Hosting.** Your data is hosted on Microsoft Azure. - **Hosting.** Your data is hosted on Microsoft Azure: in Quebec (Canada) for our Quebec and Canadian customers, and in the European Union for our European customers. - **Never sold.** Sparkbay will not sell, rent or trade personal information to any third party. - **Deletion when your contract ends.** When your contract ends, we delete your organization's data from our production systems on request. - **Rights for every employee.** Employees can ask to access, correct or delete their personal information. Certification, hosting, encryption, sign-in and the documents for your security review: [Security and privacy →](https://sparkbay.com/en/security) FAQ ## Frequently asked questions ### Does the CCPA apply to employee data? Yes. Since January 1, 2023, when its exemption for employee data expired, employees, job applicants and contractors who live in California have the same rights under the CCPA, as amended by the CPRA, as any other California consumer. ### Which businesses must comply? For-profit businesses that do business in California and have more than $25 million in annual gross revenue, adjusted for inflation, or that buy, sell or share the personal information of 100,000 or more California consumers or households, or that make half or more of their annual revenue from selling or sharing personal information. ### What must the notice at collection say? Which categories of personal information you collect, including sensitive personal information, why you collect them, whether you sell or share them, and how long you keep each category. Give it at or before collection, so before the survey opens. ### How do other US states treat employee data? Most other state comprehensive privacy laws, such as Virginia's and Colorado's, exclude information about people acting in an employment context. Check the laws of each state where your people work. ### How does Sparkbay handle our employees' personal information? Sparkbay processes it on your behalf. Sparkbay will not sell, rent or trade personal information to any third party, and never shares your results with another organization. ### Can employees ask to delete their survey answers? Yes. Under the CCPA, employees can ask your business to delete personal information collected from them, with exceptions such as information you must keep by law. With Sparkbay, employees can ask to access, correct or delete their personal information. #### Surveying employees in California? [Schedule a demo](https://sparkbay.com/en/request-demo)