CPRA Exemptions: What California Requesters Need to Know
CPRA exemptions are the statutory and judicially interpreted categories that allow California government agencies to withhold or redact specific records, even though the California Public Records Act (Gov. Code §6250 et seq.) presumes disclosure as the default. The most common exemptions you will encounter cover personnel and medical files, law enforcement investigatory records, attorney-client communications, privacy-protected information, trade secrets, preliminary drafts, security and safety records, pending litigation materials, and test questions. Courts interpret these exemptions narrowly, and agencies carry the burden to justify any withholding.
If an agency denies your request or redacts records, three steps matter immediately:
- Ask for segregated disclosure. Under the CPRA, agencies must redact only the exempt portions and release the rest. Demand that in writing, citing Gov. Code §6254.
- Request the statutory citation. Any denial must identify the specific exemption. A vague “privacy” label is not enough. Ask the agency to name the exact code section.
- Appeal or seek counsel. You can file an administrative appeal, petition for a writ of mandate in superior court, or contact a California public records attorney if the denial looks pretextual.
Table of Contents
- What is the California Public Records Act and how does disclosure work?
- What counts as a “public record” under the CPRA?
- Which agencies and bodies are subject to the CPRA?
- What CPRA exemptions will you most likely encounter?
- How do specific CPRA exemptions actually work in practice?
- How does the CPRA “catch-all” balancing test work?
- How do agencies process CPRA requests and claim exemptions?
- How do you challenge a CPRA exemption denial?
- What statutes and cases govern CPRA exemptions?
- Key Takeaways
- When does a CPRA exemption dispute require a lawyer?
- Javitchlawoffice can help you enforce your CPRA rights
- Primary sources and further reading
What is the California Public Records Act and how does disclosure work?
The CPRA is California’s primary public access law. It requires state and local government agencies to disclose records they create or maintain unless a specific exemption applies. The statute is codified at Gov. Code §6250 et seq., and its core principle is straightforward: government records belong to the public.
California courts interpret the CPRA broadly in favor of disclosure. That means the burden sits entirely on the agency, not the requester. When an agency wants to withhold a record, it must point to a specific statutory exemption or demonstrate that the public interest in nondisclosure clearly outweighs the public interest in disclosure under the balancing provision at Gov. Code §6255.
Two provisions do most of the structural work. Section 6254 lists specific mandatory and discretionary exemptions. Section 6255 is the catch-all: it lets agencies withhold records that do not fit a listed exemption, but only when they can show nondisclosure clearly serves the public interest for that specific record. Vague assertions do not satisfy that standard.
What counts as a “public record” under the CPRA?
A “public record” is any writing containing information relating to the conduct of the public’s business that is prepared, owned, used, or retained by a state or local agency. “Writing” is defined broadly: it includes emails, text messages, photographs, video recordings, audio recordings, maps, and any other tangible medium.
Common examples of records agencies must produce when requested:
- Emails about official government business sent or received on agency accounts
- Contracts, bids, and procurement files
- Surveillance footage retained by a public agency
- Meeting minutes, agendas, and staff reports
- Inspection reports and permit files
- Payroll records and salary data for public employees
Two categories fall outside the definition. Records that were never created or maintained by the agency are not public records, even if they relate to public business. Purely personal communications, such as a city employee’s texts about a family matter sent on a personal phone, are also excluded, provided they have no connection to official duties. The line between “personal” and “official” is frequently contested, and courts look at content and context rather than the device used.
Which agencies and bodies are subject to the CPRA?
The CPRA covers state agencies, counties, cities, school districts, special districts, and most other local public bodies. If a government entity creates, owns, or controls records related to public business, the CPRA almost certainly applies.
Private businesses are not covered, even when they contract with the government. However, records a private contractor creates on behalf of a public agency and that the agency possesses or controls can still be subject to a request. Courts look at who holds the record and whether the agency has the practical ability to obtain it.
Federal agencies are governed by the federal Freedom of Information Act, not the CPRA. If you want records from the FBI, the IRS, or another federal body, you file a FOIA request. When records exist at both levels, you may need parallel requests. Quasi-public entities, such as joint powers authorities or certain nonprofit corporations created by statute, often fall within CPRA coverage depending on their structure and funding.
What CPRA exemptions will you most likely encounter?
Most denials cluster around a handful of exemptions. Here is a quick-reference list with the statutory basis for each:
- Personnel, medical, and similar files (Gov. Code §6254©): Records whose disclosure would constitute an unwarranted invasion of personal privacy. Applies to employee evaluations, disciplinary files, and medical records. Agencies must redact, not wholesale withhold, unless the entire document is exempt.
- Law enforcement investigatory records (Gov. Code §6254(f)): Records of complaints, investigations, and intelligence files compiled for law enforcement purposes. Closed investigations receive less protection than active ones.
- Attorney-client and work product (Gov. Code §6254(k); Evidence Code §§950–962, 2018.030): Communications between agency counsel and agency clients, and attorney work product prepared in anticipation of litigation. These privileges are incorporated by reference into the CPRA.
- Privacy-protected information (Gov. Code §6254©; constitutional privacy): Records where a constitutional or statutory privacy interest outweighs the public’s interest in disclosure.
- Trade secrets (Gov. Code §6254.7; Evidence Code §1060): Proprietary business information submitted to agencies, such as formulas, processes, or financial data that would harm a business if disclosed.
- Preliminary drafts and deliberative materials (Gov. Code §6254(a)): Draft documents and notes not retained in the ordinary course of business, and internal deliberative communications. Final decisions and the factual basis for them are generally not protected.
- Security and safety records (Gov. Code §6254(f), §6254.19): Records whose release would endanger public safety, including building security plans and critical infrastructure data.
- Pending litigation (Gov. Code §6254(b)): Records prepared in connection with active litigation to which the agency is a party.
- Test questions and examination materials (Gov. Code §6254(g)): Questions, scoring keys, and related materials for licensing or civil service exams.
- Official information privilege: Information acquired in confidence by public employees in the course of their duties, where disclosure would be against the public interest.
| Exemption Category | Primary Statute | Typical Scope |
|---|---|---|
| Personnel/medical files | Gov. Code §6254© | Redact specific private data; disclose remainder |
| Law enforcement investigatory | Gov. Code §6254(f) | Active investigations more protected than closed |
| Attorney-client/work product | Gov. Code §6254(k) | Entire communication often withheld |
| Trade secrets | Gov. Code §6254.7 | Specific proprietary data; context disclosed |
| Preliminary drafts | Gov. Code §6254(a) | Drafts not retained in ordinary course |
| Pending litigation | Gov. Code §6254(b) | Records tied to active agency litigation |
| Test/exam materials | Gov. Code §6254(g) | Full withholding until exam cycle closes |
| Public-interest balancing | Gov. Code §6255 | Agency must show nondisclosure clearly outweighs |
Some exemptions are not listed in §6254 at all. The CPRA incorporates preexisting privileges from the Evidence Code and recognizes other statutes that make records confidential, including HIPAA, the Confidentiality of Medical Information Act (CMIA), the Gramm-Leach-Bliley Act (GLBA), and the Fair Credit Reporting Act (FCRA). Public-interest balancing under §6255 can limit withholding even when a listed exemption technically applies.
How do specific CPRA exemptions actually work in practice?
Personnel and medical records
The personnel exemption under §6254© is one of the most frequently invoked, and one of the most frequently abused. It does not protect entire employee files. It protects specific information whose disclosure would constitute an unwarranted invasion of personal privacy. Salary, job title, and disciplinary outcomes for public employees are generally disclosable. Home addresses, medical diagnoses, and performance evaluations are typically redacted.
California courts have consistently held that personnel exemptions are narrowly applied: agencies must redact the specific private information and release the rest of the file. An agency that withholds an entire personnel file because it contains one protected field is almost certainly overreaching.
Law enforcement investigatory records
Section 6254(f) protects records of complaints, investigations, and intelligence files compiled for law enforcement purposes. The protection is stronger for active investigations, where disclosure could compromise an ongoing case or identify confidential informants. Once an investigation closes, the public interest in accountability typically grows, and courts have ordered disclosure of investigatory records in closed cases where misconduct was alleged.
The landmark case CBS, Inc. v. Block (1986) 42 Cal.3d 646 illustrates the tension. The California Supreme Court held that law enforcement records are not automatically exempt and that courts must weigh the specific harm from disclosure against the public’s interest in oversight. Agencies cannot simply stamp “investigatory” on a file and call it done.
Attorney-client privilege and work product
These are among the strongest exemptions because they rest on constitutional and statutory foundations outside the CPRA itself. When an agency’s lawyers communicate with agency officials about legal strategy, those communications are privileged. Work product prepared in anticipation of litigation is similarly protected. The key question is whether the document was created for legal advice or litigation purposes, not merely because a lawyer touched it.
Trade secrets and sector-specific statutes
Health information governed by HIPAA and the CMIA, and financial information covered by GLBA, are commonly treated as exempt from disclosure. Critically, exemption applies to the specific data type, not the entire entity or file. An agency holding a contractor’s financial report must redact the trade secret portions and release the rest.
Preliminary drafts and deliberative materials
Section 6254(a) protects drafts not retained in the ordinary course of business and internal deliberative communications. The rationale is that candid internal debate produces better policy. But the exemption has real limits: factual information embedded in a deliberative document is generally not protected, and final decisions must be disclosed. Agencies sometimes claim this exemption for documents that are, in substance, final records dressed up as drafts.
The agency duty to segregate
Regardless of which exemption applies, agencies must segregate exempt portions and disclose the remainder of any record. A document that contains both exempt and nonexempt material cannot be withheld in full simply because part of it is protected. If an agency produces a fully redacted document where only a few lines were actually exempt, that is a red flag worth challenging.
Key point: State AG guidance makes clear that qualifying language narrows blanket exemption claims. Personnel, medical, or similar files may be exempt in part, not automatically in whole.
How does the CPRA “catch-all” balancing test work?
Gov. Code §6255 is the CPRA’s discretionary withholding provision. It allows an agency to withhold a record that does not fall under any listed exemption in §6254, but only when the agency demonstrates that “on the facts of the particular case the public interest served by not disclosing the record clearly outweighs the public interest served by disclosure.”
That standard is deliberately high. “Clearly outweighs” is not a close call. Courts have rejected §6255 claims where agencies offered only generalized assertions about privacy or administrative burden. The agency must tie its justification to the specific record at issue, not to a category of records in the abstract.
A practical example: a city withholds internal emails about a police use-of-force incident, claiming disclosure would chill candid internal communication. A court applying §6255 would weigh that interest against the public’s interest in oversight of law enforcement conduct. Given California’s strong disclosure presumption, the public oversight interest typically prevails unless the agency can point to concrete, specific harm.
Pro Tip: When an agency invokes §6255, ask it in writing to provide a specific, written balancing explanation for the particular record. Agencies that cannot articulate why nondisclosure clearly outweighs disclosure for that specific document are poorly positioned to defend the withholding in court. That written explanation also becomes your evidence if you file a petition.
How do agencies process CPRA requests and claim exemptions?
Agencies follow a defined workflow from the moment they receive a request. Understanding each step helps you spot procedural errors that can support an appeal.
- Receipt and clarification. The agency acknowledges the request, typically within 10 days. If the request is unclear, the agency may ask for clarification, but it cannot use that as a delay tactic indefinitely.
- Search. The agency must conduct a reasonable search for responsive records across relevant custodians and systems. It is not required to create new records or compile information it does not already maintain.
- Segregation and redaction. The agency reviews each responsive record, identifies exempt material, and redacts it. Nonexempt portions must be produced.
- Response. The agency produces responsive records or provides written notice explaining which records are being withheld and the specific statutory basis for each withholding. A vague “privacy” label without a code citation does not satisfy this requirement.
- Timelines. The standard response deadline is 10 days from receipt, with a possible 14-day extension for unusual circumstances. Agencies that routinely miss these deadlines are vulnerable to legal challenge.
Agencies are not required to provide an itemized list of every withheld record, but they must notify requesters when records are being withheld and state the grounds. If you receive a response that says records were withheld without identifying the exemption, that is a procedural defect.
Drafting tips that reduce exemption problems:
- Narrow your request by date range, subject matter, and custodian. Broad requests invite overbroad exemption claims.
- Specify the format you want (electronic, PDF, native file). Format disputes can delay production.
- Use precise terminology that matches agency record-keeping systems when you know it.
- Avoid open-ended requests for “all records related to” a topic. Instead, ask for specific document types: “all emails between [name] and [name] from [date] to [date] regarding [subject].”
Narrow, date-bounded requests consistently produce better results than sweeping ones, because they give agencies less room to claim the request is too burdensome or too broad to segregate.
How do you challenge a CPRA exemption denial?
You have real options when an agency refuses to produce records or over-redacts. The process moves in stages, and knowing when to escalate matters.
- Send a reconsideration letter. Write to the agency, identify the specific records withheld, challenge the exemption claim with a statutory argument, and ask for a written response. Cite the agency’s burden of proof and request the specific balancing explanation if §6255 was invoked. This step creates a paper trail.
- Exhaust any internal appeal process. Some agencies have an internal appeal or ombudsman process. Check the agency’s CPRA policy. Exhaustion is not always legally required, but it can produce results without litigation and strengthens your record.
- File a petition for writ of mandate. Under Gov. Code §6259, you can file a petition in superior court asking a judge to order the agency to produce the records. The agency bears the burden of proving the exemption applies. Hearings can be expedited in some courts.
- Discovery and hearing. The court may review the withheld records in camera (privately) to determine whether the exemption is valid. This is one of the most powerful tools available, because agencies cannot simply assert privilege without judicial scrutiny.
- Fee shifting. If you prevail, you are entitled to recover attorney’s fees and litigation costs under Gov. Code §6259(d). That fee-shifting provision is a meaningful incentive for agencies to comply and for attorneys to take meritorious cases on contingency.
When should you bring in a lawyer? Complex redaction disputes, privilege claims that appear designed to hide misconduct, or a pattern of refusals across multiple requests are all situations where legal help changes the outcome. An attorney can fight government denials by crafting precise demand letters, filing petitions, and pursuing fee recovery that makes the litigation economically viable.
Before contacting counsel, gather your documentation: copies of the original request, the agency’s written response, any follow-up correspondence, and notes on what records you believe exist and why. That record is what a lawyer needs to assess your case quickly.
What statutes and cases govern CPRA exemptions?
| Statute / Case | What It Covers |
|---|---|
| Gov. Code §6250 | Statement of purpose; disclosure presumption |
| Gov. Code §6252 | Definition of “public record” and covered agencies |
| Gov. Code §6254 | Enumerated specific exemptions (personnel, law enforcement, drafts, litigation, etc.) |
| Gov. Code §6255 | Public-interest balancing test (catch-all discretionary withholding) |
| Gov. Code §6259 | Enforcement: petition for writ of mandate; fee shifting |
| CBS, Inc. v. Block (1986) 42 Cal.3d 646 | Law enforcement records not automatically exempt; courts must weigh specific harms |
| Evidence Code §§950–962 | Attorney-client privilege incorporated into CPRA |
| Evidence Code §1060 | Trade secret privilege |
The full text of the CPRA is available through the California Legislative Information portal. For annotated versions with case citations, Westlaw and Lexis carry the California Government Code with full annotation. The California Attorney General’s office publishes guidance on CPRA compliance that is useful for lay readers.
One important distinction worth flagging: the acronym “CPRA” is used for both the California Public Records Act and the California Privacy Rights Act (the privacy law that amended the CCPA). These are entirely different statutes with different exemptions and different processes. The employee and B2B exemptions that were temporary under the privacy law expired on January 1, 2023. Public records exemptions under the Public Records Act are statute-based and unaffected by those privacy law changes. If you are researching government transparency, you want the Public Records Act, not the privacy statute.
Key Takeaways
California agencies must disclose government records by default, and any exemption claim requires a specific statutory basis and, often, a record-by-record justification.
| Point | Details |
|---|---|
| Disclosure is the default | Agencies bear the burden of proving an exemption applies; requesters do not need to justify their request. |
| Exemptions are narrow and specific | Common exemptions cover personnel files, law enforcement records, attorney-client communications, trade secrets, and drafts, each with defined limits. |
| Redaction, not wholesale withholding | Agencies must segregate and release nonexempt portions of any record, even when part of it is protected. |
| Challenge denials with a paper trail | Send a reconsideration letter citing the specific statute, then file a petition for writ of mandate if the agency refuses; prevailing requesters can recover attorney’s fees. |
| Javitchlawoffice enforces CPRA rights | The firm drafts demand letters, files petitions, and pursues fee recovery for requesters facing improper denials or overbroad redactions. |
When does a CPRA exemption dispute require a lawyer?
Most requesters underestimate how often agencies use exemptions as a first line of defense rather than a last resort. The statutory framework is clear, but enforcement is a different matter. Agencies know that most requesters will not litigate, and that asymmetry shapes how denials are written.
The situations that most reliably justify calling an attorney are not always the dramatic ones. A city that redacts 90% of a document and cites only “personnel privacy” without identifying which specific information is protected is doing something that courts have repeatedly rejected. A police department that withholds an entire investigatory file for a closed case, citing an active investigation that ended two years ago, is asserting an exemption that no longer applies. These are not edge cases. They are common patterns that experienced counsel can challenge efficiently, especially because the fee-shifting provision under Gov. Code §6259(d) means a meritorious case can be taken without the requester bearing the full cost.
What legal representation actually adds is precision. An attorney can draft requests that are specific enough to foreclose overbroad exemption claims, demand a written balancing explanation that the agency must then defend in court, and identify when a pattern of refusals suggests records are being withheld to conceal misconduct rather than to protect a legitimate interest. Understanding what direct attorney access means in California procedural terms also matters: once counsel is involved, the agency’s response posture often shifts.
The practical advice: if you receive a denial that cites a vague privilege, if redactions appear to cover factual information rather than deliberative content, or if the agency has refused multiple related requests without adequate explanation, those are the moments to stop sending letters and start consulting a lawyer.
Javitchlawoffice can help you enforce your CPRA rights
When an agency stonewalls a legitimate records request, the difference between getting the records and walking away empty-handed often comes down to whether someone is willing to file a petition and pursue fee recovery.
Javitchlawoffice represents California requesters in CPRA disputes, from drafting targeted demand letters that force agencies to justify every redaction, to filing petitions for writ of mandate in superior court when agencies refuse to comply. The firm’s public records practice covers the full range of enforcement options, including fee-shifting litigation that makes it economically viable to fight improper denials. Where records requests intersect with discrimination or civil rights investigations, the firm’s experience in discrimination litigation adds another layer of strategic depth.
If you have received a denial, a non-response, or a document so heavily redacted it is useless, contact Javitchlawoffice for a case assessment. Bring your original request, the agency’s written response, and any follow-up correspondence. That is enough to start.
Primary sources and further reading
For requesters doing their own research or preparing to work with counsel, these are the sources worth bookmarking:
- Gov. Code §6250 et seq. — Full text of the California Public Records Act, including §6254 (specific exemptions) and §6255 (public-interest balancing). Best for lawyers and anyone who wants to read the primary law directly.
- Gov. Code §6254 (Justia) — Annotated version of the specific exemptions list with historical notes. Useful for understanding how individual exemptions have been interpreted.
- California Public Records Act FAQs (POST) — The Commission on Peace Officer Standards and Training publishes a plain-language FAQ that covers agency obligations and exemption scope. Good for lay readers and agency staff alike.
- UC Legal CPRA Summary — A detailed summary of the CPRA’s framework, exemptions, and agency obligations prepared for University of California legal staff. Practical and well-organized for nonlawyers.
- California Attorney General CCPA page — Useful for understanding the distinction between the California Privacy Rights Act (privacy law) and the California Public Records Act (government transparency law), which share the “CPRA” acronym.
- Javitchlawoffice: How to Sue for Public Records — A practical guide to filing petitions and pursuing litigation when agencies improperly withhold records. Written for requesters considering legal action.
This article provides general legal information about California Public Records Act exemptions. It is not legal advice. For guidance specific to your situation, consult a qualified California attorney or verify current rules with the relevant primary source.
Recommended
- California Public Records Act Lawyer: Enforcing Your Right to Government Transparency | Javitch Law Office
- FOIA Requests: Accessing Government Records in California and Federal Agencies | Javitch Law Office
- Public Records & FOIA Attorneys | California & Federal
- How to Sue for Public Records: A Guide to FOIA and State Records Litigation | Javitch Law Office