Employee Data Portability Rights When Exiting a PEO
Employers must secure employee data rights before—not during—a PEO exit.
Leaving a PEO is a data-recovery event with hard deadlines, not simply a matter of switching vendors, and employers who treat it as a procurement decision rather than a records transfer find out too late what they don't have.
Why PEO exits create a data-recovery problem
Under co-employment, the PEO has acted as the operational custodian of nearly every piece of employee data a company depends on: payroll history, benefit elections, enrollment dates, dependent information, beneficiary designations, waiver forms, and supporting paperwork such as marriage certificates and birth certificates collected during enrollment. For as long as the relationship runs, that arrangement works fine. Problems start the day the relationship ends, because custody of that data does not transfer on its own. The employer has to ask for it, and most PEO contracts don't make the asking easy.
Many agreements say nothing at all about how data moves on exit, which leaves the departing employer to negotiate access during the termination window itself, at the exact moment its leverage is weakest. An HR team that assumes the data will simply show up at the end of the contract is making a costly assumption, and the cost usually lands on employees first, in the form of coverage gaps, wrong W-2s, or missed COBRA deadlines.
Record categories that must transfer
Not every category of employee data carries equal weight when a PEO relationship ends, and knowing which records create immediate downstream risk is the first job of any exit plan.
Current benefit elections sit near the top of that list, because they tell a new broker which carrier and plan each employee is supposed to move into, and without them, correct placement becomes guesswork. Beneficiary designations govern how life insurance and retirement plan distributions actually get paid out, and an error in this category is most likely to appear when a beneficiary is filing a claim, which is the worst possible moment to discover a recordkeeping gap. Waiver forms for employees who declined coverage matter for a more mundane but no less serious reason: they document that the employee made an affirmative choice to decline, and without them on file, the employer has no way to demonstrate ACA offer-and-decline compliance if asked.
Payroll figures carry a time pressure of their own. Confirming that split in writing before the relationship ends is what keeps employees from receiving two conflicting W-2s for the same year.
COBRA records close out the list, and they are arguably the most time-sensitive of all. The employer must send a COBRA notice within a strict statutory window after a qualifying event, and without current enrollment and dependent data already in hand, hitting that window is close to impossible.
The legal landscape for employer data rights
The legal tools that bear on PEO data portability don't cover the same ground evenly. CCPA offers the strongest statutory footing, but only for California employees. ERISA creates obligations that force record retention indirectly, without ever using the word "portability." And for most other situations, the PEO's own service contract is the only instrument an employer has, for better or worse.
California's law is the clearest case because its exemption for HR data expired on January 1, 2023. Since that date, California employees carry the same privacy rights as any consumer under the CCPA, including the right to access and receive their personal information in a format that's readily usable and transferable to another entity. That includes the right to know what data has been collected, the right to correct inaccurate entries, and the right to delete information the business no longer needs for a disclosed purpose, and none of these rights disappear when the PEO relationship ends. As of mid-2026, California remains the outlier among states. In practical terms, this means an employer with California worksite employees has real standing to demand records in machine-readable, transferable form during an exit negotiation, rather than accepting a proprietary export or a PDF that someone has to retype by hand. CCPA grants rights to the employee, not a direct right for the employer to demand a bulk export on its own behalf. The employer's leverage here is derivative. It has to be able to respond to an employee's data request, and responding requires first holding the data itself, which is what pulls the employer into the negotiation in the first place.
A handful of narrower state laws apply in specific situations. Illinois's Biometric Information Privacy Act covers workplace biometric identifiers, fingerprints, hand scans, face geometry, and voiceprints, and it comes with substantial per-violation penalties and a private right of action. Colorado's SB 26-189 will reach automated decision-making tools used in employment decisions involving Colorado residents once it takes effect on January 1, 2027, which matters for any employer whose PEO used algorithmic screening in hiring, promotion, or pay decisions.
ERISA works differently. Because of ERISA's fiduciary duties and disclosure requirements, benefit enrollment records are plan documents, and the employer, as plan sponsor, is legally on the hook for maintaining them. A PEO that withholds or destroys plan-related records stands in the way of the employer's own ability to meet federal filing obligations.
Outside California, and for data categories ERISA doesn't touch, the service contract is usually all an employer has, and most contracts are either silent on portability or written in terms that favor the PEO. The obvious objection is that by the time a departing employer is pointing to contract language, it has already lost most of its negotiating leverage. That objection is correct. The right moment to secure data portability terms is during contract negotiation or renewal, long before anyone is thinking about an exit date.
Why the format of the data handoff matters
Getting the right records back solves only half the problem, and the format they arrive in catches even careful operators off guard. Receiving employee data as a proprietary export or a stack of PDFs is close to the same thing as not receiving it at all: it can't be imported into an HRIS, a new broker can't process it, and someone has to retype it by hand, which introduces errors and burns time the employer doesn't have during a transition.
CSV and XML are the formats that actually work, because most HRIS platforms can import them directly. PDF reports and proprietary exports require manual entry and should be treated as a fallback, not a deliverable. The CCPA itself requires that employee data be handed over in a "readily usable format" that allows the person to transfer it elsewhere, a standard that effectively rules out PDF as an acceptable compliance format for California employees. Across both GDPR and CCPA guidance, PDF generally doesn't qualify as machine-readable at all, and the frameworks instead point toward structured, commonly used formats like JSON, CSV, or XML.
If a PEO pushes back on providing data in one of these formats, the first move is to point to whatever data portability language exists in the contract. If that language is missing or too weak to lean on, the next step is escalating past the account manager to the PEO's legal or compliance team directly.
The Online Privacy Act of 2026, introduced in the House as H.R. 8014 on March 19, 2026, is a federal bill worth watching even though it is not yet worth relying on, and referred to the Energy and Commerce, Judiciary, and Science, Space, and Technology committees. It currently has one sponsor and has not passed. The bill proposes a demanding portability standard: for "portable categories" of services, covered entities would need to support both user download and a real-time API for sending personal information to another covered entity. Nothing about this bill creates a present obligation for any PEO. Its value right now is as a signal of where federal policy appears to be heading, not a rule anyone can cite today.
Negotiating a clean data handoff before the PEO relationship ends
The best window for securing data portability terms runs from the moment the contract is signed through the start of the termination notice period. Employers who wait until the termination date itself to raise format and transfer questions are negotiating from the weakest position they will ever occupy.
The work starts before a contract is even signed or renewed. That's the moment to insist on explicit data portability language, spelling out which record categories transfer, in what format, on what timeline, and ideally at no cost. It's also the moment to find out whether the PEO's benefit plan is structured as a multiple-employer plan under ERISA, and to get in writing who is responsible for filing Form 5500 both during the relationship and after it ends. Confirming auto-renewal terms and early termination penalties at the same time lets the employer plan the data recovery timeline around known contract milestones.
Once the notice period begins, the employer should submit a formal written data export request the same day it submits termination notice, rather than waiting for the PEO to take the first step. That request should specify formats explicitly, CSV or XML for payroll and enrollment data, along with field-level schema documentation so the receiving HRIS can map every column without guessing. It should also nail down, in writing, how W-2 reporting will split if the exit falls mid-year, meaning which wages the PEO reports and which the successor employer or payroll provider picks up. And it needs to settle the COBRA handoff clearly: who sends notices, who administers continuation coverage, and what date the cutover actually happens.
When a PEO resists or drags its feet, California employers have a specific lever to pull. Invoking CCPA data subject access request rights directly works because the PEO is a covered business, and the employer carries its own compliance obligation to respond to employee data requests, which it can only do if it holds the data. Where the contract has portability language, reference it in writing. Where it doesn't, escalate to the PEO's legal or compliance team and keep a written record of every request and every delay. It helps to set a hard deadline tied to the plan termination date, and to remember that the COBRA notice clock doesn't start on the qualifying event itself. It starts when the plan administrator receives notice of that event, which the employer must provide within 30 days, and it does not wait for enrollment records to finally arrive.
Once the data is in hand, the work isn't finished. The export needs to be checked against the employer's own headcount and enrollment records before the PEO relationship officially ends, because gaps found afterward are much harder to fix. The data needs to go into the successor HRIS or broker platform before any new coverage effective dates hit, so there's no gap in what employees can see about their own benefits. And a complete copy of every transferred record should be kept under the employer's own ERISA recordkeeping obligations, regardless of what the successor broker or HRIS system holds on its own.
Ongoing compliance obligations the employer takes on once it holds its own data
The instant employee data moves from the PEO to the employer, the employer takes on three roles at once: data controller, plan recordkeeper, and compliance anchor. These are responsibilities the PEO carried quietly for years, and none of them come with a manual when they land back on the employer's desk.
Employers sponsoring ERISA-governed group health and welfare plans with at least 100 plan participants at the start of the plan year have to file Form 5500, due seven months after the plan year ends, which for a calendar-year plan means July 31 of the following year. Missing that filing carries a daily penalty, and while the DOL's Delinquent Filer Voluntary Compliance Program offers a way to self-correct before enforcement catches up, that relief only helps an employer that already knows the obligation exists. There's no small-employer exemption from ERISA's fiduciary duties either: plan document maintenance and summary plan description distribution are the employer's job from the moment it has its first employee, PEO or no PEO.
For California employees, the CCPA keeps generating obligations long after the PEO is gone. Employers must give a clear privacy notice at or before collecting personal information, spelling out the categories collected, the business purpose, how long it's kept, and how employees can exercise their rights. Data can't be retained longer than reasonably necessary, and employers now need Data Processing Agreements with any vendor touching employee data, along with regular compliance audits. Employees keep their rights to access, correct, delete, and limit the use of sensitive personal information, and those rights don't pause during a transition. The employer now has to be the one answering them directly.
Multi-state payroll adds another layer. State unemployment tax registration, state-specific paid leave rules, and nexus questions that the PEO used to absorb all revert to the employer the day the relationship ends, and the payroll data recovered during the exit becomes the starting point for calculating opening balances and contribution obligations in every state where the company has employees.
An employer that walks away from a PEO without a plan for these obligations hasn't solved its problem. It has relocated it to its own desk. Real independence from a PEO means either building the internal capacity to carry benefits administration, compliance monitoring, and employee support directly, or finding a service partner that can do the same work without requiring a co-employment arrangement to make it happen, which is the gap Spine, an AI-native benefits brokerage for tech companies that handles plan design and compliance at no cost to the employer, is built to fill.
