Hey, welcome to VoraPrep Audio. Glad you’re here.
So let’s talk about a situation that feels very real, very fast for a lot of HR pros. Imagine your company, based right here in the US, just acquired a smaller company over in Germany. It’s exciting. You’re in charge of integrating everyone, so you start pulling the German employee data into your main HR system—your HRIS. All their personal info, performance reviews, you name it. It’s all getting transferred to servers in the US.
Then you get an email. It’s from a former employee in Germany. He’s citing something called the ‘right to be forgotten’ and he wants everything—and he means *everything*—deleted. Performance reviews, disciplinary records, all of it. And your team just freezes. Because in the US, we don't really have that right. In fact, you know you’re supposed to keep some of those records for a few years, just in case of litigation.
So what do you do? You’re stuck between a European law you’ve only heard about and your own company’s US-based legal policies. This is exactly the kind of scenario the exam loves to throw at you, because it’s not just about memorizing a rule; it’s about navigating a direct conflict of laws.
Let's break down what’s really going on here. We’re talking about global data privacy regulations, and the two big ones you need to know are GDPR and CCPA.
GDPR is the General Data Protection Regulation. It’s the rulebook for the entire European Union. And the first thing to get in your head is that it has a very long reach. It doesn't matter if your company is in Ohio; if you have employees in France or are processing the data of anyone in the EU, GDPR applies to you.
Think of an individual's personal data like it has its own passport. GDPR sets the rules for where that passport is valid and how it can travel. And it's built on a few core principles.
It starts with being lawful, fair, and transparent. Basically, you can't just secretly collect data. You have to have a legitimate, legal reason for processing it, and you have to tell people what you’re doing in plain language.
Then there's this idea of purpose limitation and data minimization. This is huge for HR. It means you can only collect data for a specific, explicit reason, and you can only collect what you absolutely need for that reason. It's like packing for a business trip. You pack a suit and a laptop because you're going to a meeting. You don't pack your skis and a swim-suit just in case. So, for a new hire, you collect their bank details for payroll. That’s the purpose. You don’t also ask for their social media handles just to have them. That’s data minimization.
Of course, the data has to be accurate. If an employee moves, you need to update their address. And you can’t keep it forever. That’s storage limitation. Once the reason you collected the data is gone—say, long after an employee has left and the legal retention period is over—you have to get rid of it.
And all of this has to be done securely—that’s integrity and confidentiality. You need to protect that data from being lost, stolen, or seen by someone who shouldn't. Finally, there's accountability. This is the big one. It means YOU, the company, the data controller, are responsible for all of this and you have to be able to prove you’re complying.
Now, over on this side of the Atlantic, we have the CCPA, the California Consumer Privacy Act, which was updated by the CPRA, the California Privacy Rights Act. This is California’s law, and it now fully applies to HR data. So if you have employees in California, this is your world.
The rights look a little similar to GDPR's but have their own flavor. There’s the ‘right to know.’ An employee can ask you, "Hey, what personal information do you have on me, where did you get it, and who have you shared it with?" And you have to be able to tell them.
Then there's the ‘right to delete,’ which is what trips people up. An employee can ask you to delete their personal info. But—and this is a big but for HR—there are exceptions. A major one is for complying with legal obligations. So if you need to keep payroll records for the IRS or performance reviews for a certain number of years to comply with employment law, you can. You don't have to wipe everything.
Californians also get a ‘right to correct’ inaccurate information. Simple enough. And a ‘right to opt-out’ of their data being sold or shared. A newer one is the ‘right to limit the use and disclosure of sensitive personal information.’ This covers things like your ethnic origin, your religious beliefs, your health information, or union membership. Employees can say, "You can use this for the specific purpose I gave it to you for, but not for anything else."
So, if you’re trying to keep them straight, think of it this way: GDPR is generally stricter, especially on getting permission upfront and on moving data across borders. If you want to move employee data from the EU to the US, you can't just do it. The US isn't considered to have an "adequate" level of data protection. So you need special legal guardrails in place, like Standard Contractual Clauses—SCCs—or for bigger companies, Binding Corporate Rules, or BCRs. These are basically legal agreements that promise to protect the data to the EU's standards.
CCPA, on the other hand, is more focused on giving people rights to control their data after it's been collected—the right to know, delete, and opt-out.
And both laws are really serious about data breaches. If you have a breach under GDPR, you have to notify the authorities within 72 hours if there's a risk to people. Under CCPA, you have to notify the affected individuals as quickly as possible. HR is always on the front lines here, helping figure out whose data was impacted.
One more piece of jargon that’s super practical: DPAs, or Data Processing Agreements. If you use a third-party vendor for anything—payroll, your HRIS, background checks—and they handle your employee data, you need a DPA. It’s a contract that locks them into following the rules and protecting that data just as carefully as you would. Under GDPR, they're mandatory. As an HR leader, you’re the one making sure these are in place with all your vendors.
Okay, so let's make this a practical plan. How do you actually handle this stuff?
First, you have to identify which regulations even apply. Where are your employees? If you have people in California, CCPA is on your plate. If you have even one employee in Germany, GDPR is, too.
Next, you have to map your data. You need to know exactly what employee data you’re collecting, from applications to exit interviews, where it’s stored, and who you’re sharing it with. It’s an inventory. A data audit.
Then, for GDPR especially, you need to establish your lawful basis for processing. A lot of times in HR, it's not actually consent. It's often "contractual necessity"—like, I need your bank info to pay you, as per our employment contract. Or it’s a "legal obligation"—I need your tax information to report to the government.
After that, you need to build the tools for people to exercise their rights. How does an employee in California actually submit a ‘right to know’ request? Is there a form? An email address? You have to have a clear, working process.
And if you are moving data across borders, like in our Germany example, you have to secure that transfer. That means getting those Standard Contractual Clauses in place *before* you move the data.
Then you have to vet your vendors. Before you sign with a new payroll provider, you need to do your due diligence on their security and get that Data Processing Agreement signed.
Finally, you need a data breach response plan, and you need to practice it. When a breach happens, it's too late to figure out who's supposed to do what.
Let's walk through an example. An HR team gets a data access request from an employee in Germany. She wants a copy of *all* her personal data—performance reviews, salary history, even health records.
Okay, step one for the HR team: verify her identity. You can't just hand over sensitive data to anyone who asks. Once that's confirmed, the team starts gathering everything. As they pull the performance reviews, they have to be careful. If a manager’s review of her mentions another teammate by name, they have to redact that other person's name. They can only release her data. When they get to the health records, they double-check the original reason they collected it. Was it for a disability accommodation? Did they get explicit consent? They have to confirm their lawful basis.
Finally, they bundle it all up and provide it to her in a clear, easy-to-read format. And they have to do all of this within one month. Document everything. That's accountability.
Now, let's talk about where exam questions try to get you.
One common trap is mixing up GDPR's 'right to be forgotten' with CCPA's 'right to delete'. They sound the same, but CCPA has more explicit exceptions written into the law for things like legal compliance. So in that opening scenario with the German employee, you’d have to figure out which data you *can* delete versus which data you *must* keep to comply with other laws. You can’t just say no, but you also don’t have to delete everything.
Another trap is about data transfers. An exam question might say a US company stores its EU employee data on its US servers and uses strong encryption. Is that okay? No. Encryption is great, it’s necessary for security, but it is *not* a legal mechanism for a cross-border transfer under GDPR. You still need the SCCs or BCRs. The location of the employee, the data subject, is what matters.
And be careful with the history of CCPA. A question might try to trick you by referencing the old rules, when HR data had a lot of exemptions. Those are gone. The California Privacy Rights Act, or CPRA, made it permanent: HR data is fully covered. Assume the current rules apply.
Let's try a couple of quick scenarios.
(pause)
They absolutely must put a cross-border data transfer mechanism in place. Since the data is going from France (in the EU) to Texas (not an 'adequate' country), they need something like Standard Contractual Clauses signed between the French entity and the US parent company. Without that, the transfer is illegal.
Okay, second one. An HR manager in California gets a request from a former employee to delete everything under CCPA—application, offer letter, performance reviews. But legal says they need to keep employment records for seven years. How should HR respond?
(pause)
The HR manager needs to balance the two. They should tell the employee, "We’ve received your request and will delete the data that we are not legally obligated to keep." But they must also explain that certain records, like their application and performance reviews, are being retained to comply with federal and state legal retention requirements, which is a specific exception under CCPA. They delete what they can, and they explain why they’re keeping the rest.
If you want to practice these kinds of scenarios and get a feel for how they’re tested, VoraPrep is a full exam-prep app. It’s got lessons, thousands of practice questions, and even an AI tutor to help you break things down. You can get started for free at Vora Prep dot com.
So, to wrap this all up, what are the absolute must-knows for the exam?
Remember GDPR's extraterritorial reach. It follows the EU resident, not the company. For any data you process, you need a lawful basis under GDPR. And you have to be ready for data subject rights, especially the right to erasure and access. For cross-border transfers out of the EU, you need safeguards like SCCs.
For California's CCPA and CPRA, remember it now fully covers HR data. Know the key rights: the right to know, delete, correct, and limit the use of sensitive data. And for both, you need a plan for data breaches and you need to have Data Processing Agreements with your vendors.
I know this can feel like a lot of legal alphabet soup. But it all comes down to treating employee data with respect, being transparent about what you’re doing with it, and having a plan. You can do this.