Responding to a Bundled California CCPA, § 1198.5, § 226, and § 432 Demand Letter

Why Plaintiff Counsel Bundle Four California Statutes Into One Envelope

Modern California plaintiff firms rarely send a standalone personnel-file request anymore. Bundling Labor Code §§ 226, 432, and 1198.5 with a CCPA consumer access request is designed to trip overlapping HR and Privacy queues.

Every HR practitioner supporting a California workforce eventually opens this exact certified-mail PDF. Six days after a contentious termination, an employment plaintiff firm serves a four-page letter captioned Notice of Representation, Litigation Hold, and Statutory Demand for Records. Inside a single numbered list, counsel demands:

1. All itemized wage statements, timecards, and payroll ledgers under California Labor Code § 226(b)–(c);
2. All signed instruments relating to obtaining or holding employment under Labor Code § 432;
3. The complete personnel file under Labor Code § 1198.5; and
4. A verifiable Data Subject Access Request (DSAR) under the California Consumer Privacy Act (Cal. Civ. Code §§ 1798.110 & 1798.130) demanding "all categories and specific pieces of personal information, including all internal emails, Teams/Slack messages, and supervisor notes referencing our client."

Watch how uncoordinated people operations and privacy teams stumble into two opposite traps in Week 1. Trap One: HR sees "CCPA" in the subject line, forwards the PDF to the corporate privacy inbox, and the privacy analyst logs a standard 45-calendar-day DSAR ticket—missing Day 21 (§ 226) and Day 30 (§ 1198.5) completely and triggering two automatic $750 statutory penalties plus mandatory attorneys' fees under §§ 226(f) and 1198.5(k). Trap Two: an anxious coordinator dumps unredacted manager Slack exports, counsel-directed investigation memos, and coworkers' disciplinary names into a single zip folder on Day 20—handing opposing counsel privileged work product and violating third-party employees' privacy before a complaint is ever filed.

Meanwhile, brushing off the CCPA portion as "just for retail website shoppers" is dead wrong. Ever since the CCPA's workforce exemption expired on January 1, 2023, job applicants, employees, and former employees at CCPA-covered businesses (for example, exceeding the inflation-adjusted gross revenue threshold above $25M/$26.625M) hold full statutory access rights—underscored when the California Privacy Protection Agency (CPPA) imposed a $1.35 million enforcement fine on Tractor Supply in September 2025 in part for failing to honor job-applicant privacy obligations.

Splitting the Letter on Day 0: Exact Calendar Arithmetic Across All Four Clocks

Every clock in a bundled California demand counts calendar days—except the 10-business-day CCPA receipt confirmation. Split the letter into three staged delivery tranches on Day 0 so no early deadline waits on a slower search.

Suppose the demand arrives via email or certified mail on Monday, November 2 (Day 0). Do not build one combined zip file. Run four distinct statutory tracks with staggered sign-offs:

• By Business Day 10 (Monday, November 16) — CCPA Receipt Confirmation & Authorized-Agent Check: Under CPPA regulations (11 CCR § 7021), confirm receipt of the CCPA request within 10 business days. Simultaneously verify authorized-agent authority under 11 CCR § 7063: for a CCPA "specific pieces" request submitted by an attorney, require signed written permission from the former employee authorizing the agent to submit the CCPA request (note that signed employee authorization typically accompanies the attorney's engagement Enclosure A; if omitted, request it promptly on Day 2 rather than sitting silent until Day 44!).
• Tranche 1 · By Calendar Day 21 (Monday, November 23) — Lab. Code § 226 Payroll + § 432 Signed Instruments: Produce itemized wage statements, hours-worked/timecard summaries, pay rates, deductions, paid-sick-leave balances, and all § 432 signed instruments (offer letter, arbitration agreement, handbook receipts, commission agreements, NDAs). Because § 432 requires copies "upon request" without a 30-day cushion, bundling § 432 into your Day-21 payroll tranche eliminates any argument of unreasonable delay—and immediately puts any signed mutual arbitration agreement squarely on plaintiff counsel's desk.
• Tranche 2 · By Calendar Day 30 (Wednesday, December 2) — Lab. Code § 1198.5 Personnel File: Produce formal personnel records used to determine qualifications for employment, promotion, additional compensation, or termination/disciplinary action (applications, performance reviews, written warnings, PIPs, attendance logs, termination notice). Remember § 1198.5(h) statutory exclusions: omit records relating to investigation of a possible criminal offense, letters of reference, and ratings/reports obtained prior to employment or prepared by identifiable examination committee members.
• Tranche 3 · By Calendar Day 45 (Thursday, December 17 — or Day 90 with Timely Extension Notice) — Cal. Civ. Code § 1798.130 CCPA Response: Deliver the structured CCPA disclosure (categories of personal information collected, sources, business purposes, categories of third-party disclosures, and scoped non-exempt specific pieces of personal information—or invoke a single 45-calendar-day extension before Day 45 expires when volume/redaction complexity genuinely requires it under § 1798.130(a)(2)(A)).

Scoping the CCPA Trapdoor Without Handing Over Privileged Discovery

A CCPA request is not a civil discovery subpoena under the California Code of Civil Procedure. Apply statutory privilege exemptions, unstructured-communication boundaries, and third-party privacy redactions rigorously.

This is where professional turning points separate seasoned California practitioners from panicked first-timers: plaintiff counsel phrases the CCPA demand like a litigation Request for Production of Documents—demanding every email, Slack DM, text message, and investigation memo ever mentioning the employee's name. Before running a company-wide e-discovery export, apply four hard statutory guardrails:

1. Check the Pending-Lawsuit Boundary Accurately: Under Labor Code § 1198.5(n), the right to inspect or copy personnel records ceases during the pendency of a lawsuit filed by the employee relating to a personnel matter. Two cautions: first, a pre-litigation demand letter or PAGA notice is not a filed civil lawsuit, so § 1198.5(n) does not pause your 30-day clock pre-suit; second, the CCPA contains no automatic litigation-pendency pause analogous to § 1198.5(n). Never invent a "litigation hold delay" under CCPA.
2. Enforce Attorney-Client Privilege & Work Product (Civ. Code § 1798.145(b)): The CCPA explicitly preserves evidentiary privileges under California law. Privileged communications with in-house or outside counsel, counsel-directed investigation reports, and litigation-anticipation analyses are exempt from CCPA production.
3. Protect Third-Party Coworker Privacy & Trade Secrets: Fulfilling Employee A's CCPA request must never infringe Employee B's constitutional and statutory privacy rights (Cal. Const. art. I, § 1; Civ. Code § 1798.145(k)). Never hand over unstructured peer Slack threads containing other employees' medical facts, compensation, complaints, or candid witness identities, and never produce proprietary formulas, client pricing models, or raw security credentials (indeed, 11 CCR § 7024(d) forbids disclosing actual Social Security numbers, driver's license numbers, or financial account numbers in response to a CCPA request—state only that the category is held).
4. Watch Automated Decision-Making Technology (ADMT) Readiness: As CPPA Automated Decision-Making Technology regulations phase into enforcement (with compliance milestones running into January 1, 2027), verify whether any algorithmic scoring, productivity ranking, or automated screening tool processed the worker's profile so your categories disclosure never contradicts HRIS system logs.

Issuing the Day-3 Staged Acknowledgement and Litigation Hold

Send one calm, authoritative acknowledgement letter within three business days while triggering an internal legal hold on Day 0. Confirm agent authority and separate the Labor Code and CCPA timelines explicitly.

Never forget the invisible fifth duty inside every attorney demand letter: the moment pre-litigation counsel writes, litigation is reasonably foreseeable. Before producing a single PDF, IT and Legal must freeze auto-deletion on the former employee's mailbox, Slack/Teams workspace, badge logs, and manager messages.

STAGED RESPONSE & RECEIPT CONFIRMATION — CALIFORNIA BUNDLED RECORDS DEMAND
Via Electronic Mail | Date: [Day 3 from Receipt]
Re: Records & Privacy Request Regarding [Former Employee Name]

Dear [Counsel Name]:

We confirm receipt on [Receipt Date] of your correspondence enclosing a signed authorization from [Former Employee Name] requesting employment records pursuant to California Labor Code §§ 226, 432, and 1198.5, together with a consumer request under the California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.).

Because each statute carries distinct statutory scopes and timelines, [Company] will fulfill your client's requests on the following schedule:

1. Labor Code §§ 226(b)–(c) & 432 (On or Before [Receipt Date + 21 Calendar Days])
   Itemized wage statements, timekeeping/payroll records, and copies of employment instruments signed by [Former Employee Name] (including [Offer Letter and Mutual Arbitration Agreement, if any]).

2. Labor Code § 1198.5 (On or Before [Receipt Date + 30 Calendar Days])
   Statutory personnel records maintained regarding [Former Employee Name]'s performance or grievances, subject to statutory exclusions and redactions under Labor Code § 1198.5(g)–(h).

3. CCPA Verifiable Request (Confirmation Pursuant to 11 CCR § 7021; Production On or Before [Receipt Date + 45 Calendar Days])
   This letter confirms timely receipt of the CCPA portion of your request within 10 business days. [If signed authorization specifically referencing CCPA agent authority was omitted: Please return a signed authorization from [Former Employee Name] expressly authorizing your firm to submit a CCPA request pursuant to 11 CCR § 7063 so we may process specific-pieces disclosures.] Our CCPA response will exclude privileged communications/work product (Civ. Code § 1798.145(b)), trade secrets, restricted security identifiers (11 CCR § 7024(d)), and third-party personal information protected under California privacy law.

Sincerely,
[Employment Counsel / Senior People Operations Lead]

Coordinating Payroll, HR Operations, IT, and Outside Counsel

Four clocks fail when four departments assume someone else owns the master calendar. Assign one Legal-coordinated tracker with hard internal cutoffs five days ahead of each statutory deadline.

Set internal collection cutoffs at Day 14 (Payroll), Day 22 (Personnel File), and Day 35 (CCPA structured data) so counsel can verify consistency across all three tranches before transmittal.