EU GDPR vs California CCPA

GDPR applies to processing in the context of an EU establishment and can also apply to non-EU controllers or processors that offer goods or services to people in the Union or monitor their behaviour in the Union.

The CCPA applies to qualifying for-profit businesses that do business in California and meet statutory thresholds, and it also imposes separate obligations on service providers, contractors, and third parties.

Run GDPR Article 3 first for EU processing facts, then run a separate California-source check for CCPA applicability and thresholds instead of copying the GDPR scope answer.

GDPR assigns duties to controllers, processors, joint controllers, representatives where applicable, and DPOs where required; processor processing must follow controller instructions unless Union or Member State law requires otherwise.

CCPA rules distinguish businesses, service providers, contractors, third parties, and certain other covered entities, each with different obligations.

Do not map GDPR controller or processor labels directly to California role labels without California authority.

GDPR processing needs an Article 6 legal basis such as consent, contract, legal obligation, vital interests, public task, or legitimate interests; consent must be demonstrable and withdrawable.

CCPA focuses on purpose limitation, reasonable expectations, notice, and consumer choice rights such as opt-out of sale/sharing and limit of sensitive personal information, rather than a GDPR-style Article 6 lawful-basis test.

Keep GDPR lawful-basis analysis separate from California choice or opt-out analysis until California sources are added.

GDPR Articles 12 to 22 cover transparent communications and rights such as access, rectification, erasure, restriction, portability, objection, and safeguards for certain automated decisions; responses are due without undue delay and within one month, with a limited extension path.

CCPA gives consumers rights to know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and obtain equal treatment, and businesses generally must confirm within 10 business days and respond within 45 days, with a possible 45-day extension.

A shared request portal may be practical, but the queue must preserve the source, right type, response clock, and exception logic for each regime.

GDPR Article 30 records identify the controller or processor, purposes, data-subject and personal-data categories, recipient categories, third-country transfers, erasure time limits where possible, and security measures where possible.

CCPA records and privacy disclosures can include categories of personal information, categories of sources, categories of third parties, sale/share disclosures, request metrics, and response logs, plus California-specific notices and request-processing records.

Reuse inventories only after each field is tagged as GDPR evidence, California evidence, or shared operational context.

GDPR Article 32 requires risk-appropriate technical and organisational security measures. Article 33 requires supervisory-authority notification for notifiable personal data breaches without undue delay and, where feasible, not later than 72 hours after awareness.

CCPA request timing is more specific to the right being exercised: delete, correct, know, and ADMT appeals generally get a 10-business-day acknowledgement and a 45-day response period; opt-out of sale/sharing and limit requests generally must be handled within 15 business days.

Calendar the GDPR breach clock separately and do not use it as a California deadline.

GDPR supervisory authorities have corrective powers, and Article 83 sets administrative fine factors and upper tiers up to EUR 20,000,000 or 4% of total worldwide annual turnover for specified infringements.

The California Privacy Protection Agency can investigate, audit, and enforce the CCPA, and California law also includes civil penalties and other remedies for certain violations.

Do not combine GDPR administrative-fine tiers with California penalty statements in one unsourced risk score.

GDPR requires a DPIA before processing likely to result in high risk, including systematic extensive automated evaluation with legal or similarly significant effects, large-scale special-category or criminal-offence data processing, and large-scale systematic monitoring of publicly accessible areas.

CCPA also has risk-assessment and cybersecurity-audit requirements for certain businesses, and a GDPR DPIA can be reused only if the California-specific required information is added and the California scope is documented.

A GDPR DPIA may contain facts useful to another review, but it should not be labeled as California compliance evidence without California authority.

GDPR Chapter V governs transfers of personal data to third countries or international organisations, including adequacy decisions, appropriate safeguards such as SCCs, binding corporate rules, and derogations for specific situations.

If a team is choosing where to start, use GDPR first for EU data flows and California CCPA/CPRA first when the business activity turns on California consumer rights, CCPA notices, opt-out handling, or California-specific request timing.

Keep SCCs, transfer impact assessments, and adequacy references in the GDPR evidence set unless a California source says they answer a California requirement.