Skip to main content

Data Privacy in ERP — CCPA and US State Laws

Data privacy in ERP covers the legal and technical handling of personal data stored in enterprise systems. ERP platforms are among the largest stores of personal data in a mid-market company: customer contacts, employee and payroll records, vendor contact persons, credit and payment data. The United States has no single comprehensive federal privacy law — instead, ERP operators face sectoral federal statutes (HIPAA for health data, GLBA for financial institutions) plus a fast-growing patchwork of state laws. As of 2026, twenty states have comprehensive consumer privacy laws in force, and the count keeps rising.

The US privacy landscape in 2026

California started the wave with the CCPA (enacted 2018, effective 2020), substantially expanded by the CPRA amendments effective 2023, which also created a dedicated regulator, the California Privacy Protection Agency (CPPA). Since then, states including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Maryland, Minnesota, New Jersey, and New Hampshire have followed; Indiana, Kentucky, and Rhode Island joined with laws effective January 1, 2026. Most follow a controller/processor model familiar from the GDPR, apply above thresholds based on revenue or the number of state residents whose data is processed, and are enforced by state attorneys general — California adds its dedicated agency and a limited private right of action for data breaches. The laws are similar but not identical: Maryland's act, effective October 2025, stands out for strict data-minimization duties, and applicability thresholds vary widely. For a company selling into multiple states, the practical approach is one privacy baseline built on the strictest applicable requirements rather than twenty parallel compliance programs.

Where personal data lives in an ERP system

A data inventory across a typical mid-market ERP finds personal data in more places than most operators expect: customer masters and contact persons, quotes and order history, connected CRM records, HR and payroll modules, vendor and carrier contacts, service tickets, and user activity logs. Two points deserve emphasis. First, in California the CCPA has fully applied to employee and business-contact data since January 2023 — the HR module and the B2B customer master are in scope, not just consumer-facing records. Second, personal data leaks outward from the ERP into attached systems — data warehouses, BI extracts, test environments — and every copy inherits the compliance obligations of the original.

DSAR: handling data subject requests

All state laws grant individuals rights over their data — typically to know and access, delete, correct, and opt out of the sale or sharing of personal information; California adds the right to limit use of sensitive data. Under the CCPA, businesses must respond to a verified request within 45 days, extendable once by another 45. For ERP operators, a data subject access request (DSAR) is primarily a search problem: finding every record about one person across modules, attachments, and downstream copies. That requires person-centric data mapping, reliable identity verification of the requester, and a documented workflow with deadlines — done manually across a grown ERP landscape, a single request can consume days.

Deletion concepts vs. retention duties

The deletion right collides with retention obligations: tax records, payroll documentation, and audit evidence must be kept for legally defined periods, and every state privacy law recognizes exceptions for such legal duties. The workable ERP pattern is a retention schedule per record type combined with anonymization: transactional documents remain intact for ledgers and statistics, while identifying fields are irreversibly overwritten once no legal basis for retention remains. Physical deletion of posted documents is neither required nor desirable — it would break the audit trail. Two details separate serious deletion concepts from paper ones: backup handling (deleted data must not silently resurrect from restores) and test systems (production copies for testing need masked personal data).

GDPR exposure with EU business

US companies selling to customers in the EU, or operating EU subsidiaries, additionally fall under the GDPR, which applies regardless of where the company is established. The GDPR is stricter on several axes: every processing activity needs a legal basis, response windows are shorter, and transfers of EU personal data to US systems need a transfer mechanism such as the EU-US Data Privacy Framework or standard contractual clauses. In practice, mid-market groups with EU business tend to implement GDPR-level deletion and consent handling in the ERP once and apply it group-wide — which then covers most US state requirements as a side effect.

Selection criteria for US buyers

  • Person-centric data discovery: can the system report every record tied to one individual across modules? This is the foundation for DSAR response times you can commit to.
  • Anonymization and purge functions: built-in routines that anonymize or delete by retention rule, with logging — not one-off SQL scripts against the production database.
  • Field-level access control and encryption: role-based restriction of sensitive fields (compensation, bank details, SSNs), encryption at rest and in transit.
  • Vendor compliance posture for cloud ERP: for SaaS ERP, review the data processing agreement, subprocessor list, data residency options, and independent attestations such as SOC 2.
  • Consent and preference handling: where ERP data feeds marketing, opt-out signals must propagate into connected CRM and campaign tools.
  • Test-data masking: supported pseudonymization for non-production copies of the database.

Comparable terms

Data privacy compliance is a legal obligation toward individuals; SOC 2 is a voluntary security attestation that supports but does not replace it. The audit trail documents who changed what in the system — an enabler for privacy accountability and a data category with retention rules of its own. Clean master data management is the practical prerequisite for finding and anonymizing person records reliably.

Related Topics