Privacy and preparation
Does your employee privacy notice need to mention AI training or data licensing?
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
Your employee privacy notice needs to mention AI training or data licensing if employee personal information will be used or disclosed for that purpose, at least where a law such as the CCPA requires a notice. For an unrelated new purpose, California's rules may require consent as well, which is one reason employers often deidentify records first.
Key takeaways
- A new purpose for employee personal information generally needs an updated notice before the use begins, not after.
- Under California's rules, a purpose unrelated to the original one may need consent, not just an updated notice.
- Licensing deidentified work records puts less pressure on the notice than licensing records that still identify staff.
- Biometric data and recorded calls can carry consent rules of their own, whatever the notice says.
- A new notice does not reach former employees, so historic archives usually rely on deidentification.
When does the notice need to change?#
The employee privacy notice needs to change when employee personal information will be used or disclosed for a purpose it does not already describe. Under the CCPA, employers must give California employees and applicants notice at collection describing the categories of personal information and the purposes for using them, and a materially new purpose generally calls for updated notice before the new use. Where the new purpose is unrelated to or incompatible with the purposes already disclosed, California's regulations may go further and require consent.
Deidentification changes the analysis. If author names, signatures and other identifying details are removed before records are used or disclosed, the licensed records are generally no longer personal information. The preparation work itself still handles personal information, which many notices already cover under internal administration, but counsel should confirm yours does.
Outside California, most comprehensive state privacy laws exclude employee data, so there may be no statutory notice to update. Many employers still update one company-wide notice, because staff talk across offices and a quiet difference between states tends to surface badly.
Scenarios and their notice impact#
Scenarios differ enough that a single answer misleads, so match your plan to the closest row before drafting anything.
The high-impact rows share one feature: identifiable employee information leaves the company or feeds a new system. If the plan can be redesigned so identities are removed first, the notice question usually becomes simpler, though it is still worth a short description.
| Scenario | Notice impact | Typical approach |
|---|---|---|
| License work records after removing employee identities | Low; deidentified output is generally outside notice duties | Describe the practice briefly and document the removal methods |
| License records that keep employee names or user IDs | High; a new third-party disclosure that may need consent, not just notice | Assess consent, sale and opt-out rules with counsel before any use, or deidentify instead |
| Use employee records to train an internal AI tool | Moderate; a new internal purpose | Update the purposes section and limit what the tool ingests |
| Switch on vendor AI features in HR or collaboration systems | Moderate; new processing by a service provider | Update notice and confirm the vendor contract restricts training |
| Record or transcribe meetings and calls | High; may also trigger consent rules | Review recording consent and transcript use separately |
What the updated notice should cover#
An updated notice should cover the new use in plain terms that an employee can understand on first reading. Legal boilerplate that names no systems and no purpose tends to create the very questions it was meant to prevent.
Keep the text consistent with your customer-facing privacy policy and any trust center statements. Employees read both, and so do the buyer's diligence reviewers.
- Which categories of employee information are involved, such as work email, chat messages, tickets or project notes.
- The purpose, stated directly: for example, licensing deidentified business records to developers of AI systems.
- Whether information is disclosed to third parties, and the categories of recipients.
- Whether a disclosure may be a sale or sharing under the CCPA, and how to opt out where required.
- What is removed before any disclosure, and the commitment not to reidentify.
- Which records are never used, such as personnel, payroll and medical files.
- How long each category of information is kept, if your notice lists retention periods.
- How employees can ask questions or exercise their rights.
Notice is not consent#
Notice is not consent, and some uses of employee data need consent that a notice update does not provide. California's regulations may require consent before personal information is used for a purpose unrelated to the one it was collected for. Biometric privacy laws, such as Illinois BIPA, set their own requirements for voiceprints and face data, and call recording laws in some states require every party's consent before recording.
Consent from employees is also hard to rely on, because the power imbalance at work can make it look less than freely given. That is the practical reason many employers redesign the plan so identities are removed before records are used, rather than asking staff to agree.
Communications about working conditions raise separate employment law questions. Labor and employment counsel should review any plan involving employee chat or email, especially private channels and direct messages, before scope is final.
Sequence the update before any use#
Sequencing matters because a notice delivered after records are used cannot cover that earlier use. Follow an order that leaves a dated record at each step.
Former employees are the gap in any sequence. A new notice does not reach them, which is one reason historic archives are usually deidentified before licensing.
- Inventory the employee information in each record family under consideration.
- Decide what will be removed and what, if anything, will stay identifiable.
- Draft the notice change with counsel and HR in plain language.
- Deliver it through your usual channel, such as the HR system or intranet, and keep proof of delivery.
- Give employees a way to ask questions before records are used.
- Only then begin preparation and release.
Sample wording to adapt with counsel#
Sample wording helps because plain sentences are harder to write than they look. Adapt the lines below to your facts, delete any line that does not apply, and have counsel confirm the result against the laws that cover your workforce.
- We may license business records, such as support tickets, project notes and technical documentation, to companies that develop AI systems.
- Before any record is shared, we remove names, contact details and other information that identifies employees, and we do not attempt to reidentify anyone.
- We never include personnel, payroll, benefits, medical or background check records.
- Recipients are bound by contract not to reidentify any person and to apply the same limits to anyone they work with.
- Questions about this use can be sent to [contact], and California residents may exercise their rights by [method].
Illustrative: a consulting firm updates its staff notice#
Illustrative: a fictional operations consulting firm plans to license proposal libraries, project review notes and internal playbooks from SharePoint and Salesforce. Consultants wrote most of the material, and the firm has an office in California.
The firm decides that consultant names, emails and performance comments will be removed and that HR systems are out of scope. Counsel recommends a notice update anyway, because preparation touches employee information and leadership wants staff to hear about the project from them first.
The firm updates its single company-wide notice, explains the project at an all-hands meeting, and records the delivery date. Preparation starts only after the update goes out.
How SourceX approaches employee notices#
SourceX reviews employee notices in the Rights step of the SourceX five-step transaction, alongside contracts and customer-facing policies, and flags record families where a notice update may be needed before preparation begins.
The SourceX Evidence Packet records which notices were reviewed and when any update was delivered, as part of the privacy record the supplier approves.
Frequently asked questions
Does the employee handbook count as a privacy notice?
It can if it contains the required content and employees receive it at or before collection, but many handbooks describe acceptable use of company systems rather than the employer's own data practices. A separate privacy notice, referenced from the handbook, is easier to keep current.
Does using an AI meeting notetaker change the notice?
Usually yes. Notetakers record and transcribe conversations, which raises recording consent questions and creates new records. Describe the tool and its vendor in the notice, and decide separately whether those transcripts could ever be licensed.
What if the records are only used internally?
Internal AI use is still a purpose that may need to appear in the notice under laws such as the CCPA. It avoids the third-party disclosure questions licensing raises, but employees still expect to be told how their work records are used.
Should contractors receive the same notice?
Where a law covers contractors, as California's does for residents, they need notice too. Many companies give contractors a tailored version, since the information collected about them differs from employee records.
Do employees have to agree to the updated notice?
A notice informs; it does not usually require agreement. Where a use needs consent, such as biometric data under specific laws or an unrelated new purpose under California's rules, consent is collected separately and in writing. Keep proof that the notice was delivered, and give staff a clear route for questions.
Do job applicants need a separate notice?
Where the CCPA applies, applicants receive notice at collection like employees, and many employers use a shorter applicant version on the careers page. Applicant records rarely belong in a licensed package at all, so the update usually only needs to say that they are excluded.
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.