Use this comparison to decide which EU and California privacy duties apply and which operational evidence can be shared.
GDPR requires a for processing. The CCPA instead centers on qualifying-business scope, notice, purpose limits, consumer rights, sale and sharing opt-outs, sensitive-information limits, contracts, and California-specific risk controls.
EU GDPR and the California Consumer Privacy Act, as amended by the CPRA, can apply to the same organization but use different scope tests and control models. Test each jurisdiction separately, including whether the entity is a CCPA business. A shared inventory or request portal can support both, but a GDPR , DPIA, or transfer file does not by itself satisfy California notice, sale, sharing, opt-out preference signal, contract, ADMT, or risk-assessment rules.
Side-by-side comparison
EU GDPR vs California CCPA: separate rules, reusable operations
Use the rows to compare each legal test and decide where inventories, request tooling, assessments, contracts, and security evidence can be reused.
Based on the GDPR text and EU GDPR guidance available in the cited sources.
Second framework
California CCPA/CPRA
Based on California CPPA regulations and FAQs available in the California cited sources, covering notice, opt-out, limit, access, verification, service-provider, and enforcement rules.
EU GDPR vs California CCPA: separate rules, reusable operations
GDPR applies to processing in the context of an EU establishment and can also apply to non-EU controllers or processors that offer goods or services to people in the Union or monitor their behaviour in the Union.
Article 3 grounds GDPR establishment, offering, and monitoring scope.
offering of goods or services
The CCPA applies to qualifying for-profit businesses that do business in California and meet at least one threshold: preceding-year gross annual revenue exceeding $26.625 million, alone or in combination annually buying, selling, or sharing the personal information of at least 100,000 California residents or households, or at least 50% of annual revenue from selling or sharing California residents' personal information. It also imposes obligations on service providers, contractors, and other recipients.
The controlling business definition uses annual gross revenue in excess of the inflation-adjusted threshold; CPPA materials identify the adjusted amount.
annual gross revenues in excess of
Run GDPR Article 3 for EU processing facts, then run the California entity, activity, threshold, and exclusion tests instead of copying the GDPR scope answer.
GDPR assigns duties to controllers, processors, joint controllers, representatives where applicable, and DPOs where required; processor processing must follow controller instructions unless Union or Member State law requires otherwise.
GDPR processing needs an Article 6 legal basis such as consent, contract, legal obligation, vital interests, public task, or legitimate interests; consent must be demonstrable and withdrawable.
Supports the list of GDPR Article 6 legal bases and the need to identify the justification for processing.
consent; contract; legal obligation
CCPA focuses on purpose limitation, reasonable expectations, notice, and consumer choice rights such as opt-out of sale/sharing and limit of sensitive personal information, rather than a GDPR-style Article 6 lawful-basis test.
GDPR Articles 12 to 22 cover transparent communications and rights such as access, rectification, erasure, restriction, portability, objection, and safeguards for certain automated decisions; responses are due without undue delay and within one month, with a limited extension path.
Grounds GDPR rights and the one-month response rule.
within one month of receipt
CCPA gives consumers rights to know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and obtain equal treatment, and businesses generally must confirm within 10 business days and respond within 45 days, with a possible 45-day extension.
GDPR Article 30 records identify the controller or processor, purposes, data-subject and personal-data categories, recipient categories, third-country transfers, erasure time limits where possible, and security measures where possible.
Supports the Article 30 RoPA fields and accountability use.
purposes of processing
CCPA records and privacy disclosures can include categories of personal information, categories of sources, categories of third parties, sale/share disclosures, request metrics, and response logs, plus California-specific notices and request-processing records.
GDPR Article 32 requires risk-appropriate technical and organisational security measures. Article 33 requires supervisory-authority notification for notifiable personal data breaches without undue delay and, where feasible, not later than 72 hours after awareness.
Supports the Article 33 notification condition and DPA routing context.
unlikely to present any risk
California timing depends on the right: delete, correct, and know requests generally require confirmation within 10 business days and a response within 45 calendar days, with a possible 45-day extension. Sale/sharing opt-outs and sensitive-information limit requests generally must be acted on within 15 business days. Covered ADMT uses follow their own notice, access, opt-out, and compliance dates.
GDPR supervisory authorities have corrective powers, and Article 83 sets administrative fine factors and upper tiers up to EUR 20,000,000 or 4% of total worldwide annual turnover for specified infringements.
Article 83 grounds GDPR administrative fine factors and upper tiers.
up to 20 000 000 EUR
The California Privacy Protection Agency can investigate, audit, and enforce the CCPA, and California law also includes civil penalties and other remedies for certain violations.
GDPR requires a DPIA before processing likely to result in high risk, including systematic extensive automated evaluation with legal or similarly significant effects, large-scale special-category or criminal-offence data processing, and large-scale systematic monitoring of publicly accessible areas.
Article 35 grounds GDPR DPIA triggers and minimum DPIA content.
likely to result in a high risk
California regulations effective 1 January 2026 require risk assessments and cybersecurity audits from businesses that meet the respective triggers. A risk assessment prepared for another law may be used only if it meets the California requirements or is supplemented.
GDPR Chapter V governs transfers of personal data to third countries or international organisations, including adequacy decisions, appropriate safeguards such as SCCs, binding corporate rules, and derogations for specific situations.
Supports SCCs as a GDPR international-transfer safeguard resource.
Standard Contractual Clauses
If a team is choosing where to start, use GDPR first for EU data flows and California CCPA/CPRA first when the business activity turns on California consumer rights, CCPA notices, opt-out handling, or California-specific request timing.
Explains California rights, business responsibilities, and how to exercise them.
Businesses must generally designate at least two methods
Keep SCCs, transfer impact assessments, and adequacy references in the GDPR evidence set unless a California source says they answer a California requirement.
Chapter V supports keeping GDPR transfer safeguards distinct.
transfer of personal data
Scope boundary
EU GDPR
GDPR applies to processing in the context of an EU establishment and can also apply to non-EU controllers or processors that offer goods or services to people in the Union or monitor their behaviour in the Union.
Article 3 grounds GDPR establishment, offering, and monitoring scope.
offering of goods or services
California CCPA/CPRA
The CCPA applies to qualifying for-profit businesses that do business in California and meet at least one threshold: preceding-year gross annual revenue exceeding $26.625 million, alone or in combination annually buying, selling, or sharing the personal information of at least 100,000 California residents or households, or at least 50% of annual revenue from selling or sharing California residents' personal information. It also imposes obligations on service providers, contractors, and other recipients.
The controlling business definition uses annual gross revenue in excess of the inflation-adjusted threshold; CPPA materials identify the adjusted amount.
annual gross revenues in excess of
Operational implication
Run GDPR Article 3 for EU processing facts, then run the California entity, activity, threshold, and exclusion tests instead of copying the GDPR scope answer.
Supports separating GDPR scope analysis from comparator claims.
Territorial scope
Covered actors
EU GDPR
GDPR assigns duties to controllers, processors, joint controllers, representatives where applicable, and DPOs where required; processor processing must follow controller instructions unless Union or Member State law requires otherwise.
Supports keeping GDPR role assignments tied to GDPR role definitions.
Processing under the authority
Lawful basis and consumer choice
EU GDPR
GDPR processing needs an Article 6 legal basis such as consent, contract, legal obligation, vital interests, public task, or legitimate interests; consent must be demonstrable and withdrawable.
Supports the list of GDPR Article 6 legal bases and the need to identify the justification for processing.
consent; contract; legal obligation
California CCPA/CPRA
CCPA focuses on purpose limitation, reasonable expectations, notice, and consumer choice rights such as opt-out of sale/sharing and limit of sensitive personal information, rather than a GDPR-style Article 6 lawful-basis test.
Supports using a dedicated GDPR lawful-basis field.
reason or justification
Core obligations
EU GDPR
GDPR Articles 12 to 22 cover transparent communications and rights such as access, rectification, erasure, restriction, portability, objection, and safeguards for certain automated decisions; responses are due without undue delay and within one month, with a limited extension path.
Grounds GDPR rights and the one-month response rule.
within one month of receipt
California CCPA/CPRA
CCPA gives consumers rights to know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and obtain equal treatment, and businesses generally must confirm within 10 business days and respond within 45 days, with a possible 45-day extension.
Supports keeping GDPR rights clocks and exception records distinct.
Articles 15 to 22
Evidence record
EU GDPR
GDPR Article 30 records identify the controller or processor, purposes, data-subject and personal-data categories, recipient categories, third-country transfers, erasure time limits where possible, and security measures where possible.
Supports the Article 30 RoPA fields and accountability use.
purposes of processing
California CCPA/CPRA
CCPA records and privacy disclosures can include categories of personal information, categories of sources, categories of third parties, sale/share disclosures, request metrics, and response logs, plus California-specific notices and request-processing records.
Supports tagging RoPA content as GDPR accountability evidence.
demonstrate accountability
Timing and deadlines
EU GDPR
GDPR Article 32 requires risk-appropriate technical and organisational security measures. Article 33 requires supervisory-authority notification for notifiable personal data breaches without undue delay and, where feasible, not later than 72 hours after awareness.
Supports the Article 33 notification condition and DPA routing context.
unlikely to present any risk
California CCPA/CPRA
California timing depends on the right: delete, correct, and know requests generally require confirmation within 10 business days and a response within 45 calendar days, with a possible 45-day extension. Sale/sharing opt-outs and sensitive-information limit requests generally must be acted on within 15 business days. Covered ADMT uses follow their own notice, access, opt-out, and compliance dates.
Supports the GDPR 72-hour notification clock and breach documentation requirement.
not later than 72 hours
Enforcement
EU GDPR
GDPR supervisory authorities have corrective powers, and Article 83 sets administrative fine factors and upper tiers up to EUR 20,000,000 or 4% of total worldwide annual turnover for specified infringements.
Article 83 grounds GDPR administrative fine factors and upper tiers.
up to 20 000 000 EUR
California CCPA/CPRA
The California Privacy Protection Agency can investigate, audit, and enforce the CCPA, and California law also includes civil penalties and other remedies for certain violations.
GDPR requires a DPIA before processing likely to result in high risk, including systematic extensive automated evaluation with legal or similarly significant effects, large-scale special-category or criminal-offence data processing, and large-scale systematic monitoring of publicly accessible areas.
Article 35 grounds GDPR DPIA triggers and minimum DPIA content.
likely to result in a high risk
California CCPA/CPRA
California regulations effective 1 January 2026 require risk assessments and cybersecurity audits from businesses that meet the respective triggers. A risk assessment prepared for another law may be used only if it meets the California requirements or is supplemented.
Supports requiring source-specific labels for DPIA evidence.
Data protection impact assessment
International transfers and market-specific priorities
EU GDPR
GDPR Chapter V governs transfers of personal data to third countries or international organisations, including adequacy decisions, appropriate safeguards such as SCCs, binding corporate rules, and derogations for specific situations.
Supports SCCs as a GDPR international-transfer safeguard resource.
Standard Contractual Clauses
California CCPA/CPRA
If a team is choosing where to start, use GDPR first for EU data flows and California CCPA/CPRA first when the business activity turns on California consumer rights, CCPA notices, opt-out handling, or California-specific request timing.
Explains California rights, business responsibilities, and how to exercise them.
Businesses must generally designate at least two methods
Operational implication
Keep SCCs, transfer impact assessments, and adequacy references in the GDPR evidence set unless a California source says they answer a California requirement.
Chapter V supports keeping GDPR transfer safeguards distinct.
transfer of personal data
Practical decision rule
How should teams use this comparison?
Write separate GDPR and CCPA scope findings before reusing any control or evidence.
For each processing purpose, record the GDPR role and beside the California business or recipient role, notice purpose, sale, sharing, sensitive-information, and contract results.
Route each right through its own clock, verification, exception, response, downstream-action, and completion fields, including qualifying opt-out preference signals.
For high-risk or automated processing, assess the GDPR DPIA and Article 22 questions separately from California risk-assessment, cybersecurity-audit, and ADMT triggers and dates.
Label every shared artifact as GDPR evidence, California evidence, both with stated limits, or operational context.
Official California source for the CCPA-side decision path.
1
Section 1
Start with the two scope tests
GDPR scope turns on personal-data processing in an EU establishment or, for certain non-EU organizations, offering goods or services to people in the Union or monitoring their behavior there. It assigns controller and processor duties and requires a for each processing purpose.
CCPA scope generally turns on whether a for-profit entity does business in California, determines why and how consumers' personal information is processed, and meets at least one threshold. The current thresholds are gross annual revenue exceeding $26.625 million for the preceding calendar year, alone or in combination annually buying, selling, or sharing the personal information of at least 100,000 California residents or households, or deriving at least 50% of annual revenue from selling or sharing California residents' personal information. Separate rules can bring related entities, joint ventures, voluntary certifiers, service providers, contractors, and other recipients into scope.
Write one scope finding for GDPR and one for CCPA, including the entity, activity, people, data, territory, threshold, role, and exclusion relied on.
Use GDPR lawful-basis fields only for GDPR. Use separate California fields for notice, collection and use purposes, sale, sharing, sensitive personal information, opt-out signals, and role-specific contracts.
Tag each shared record as GDPR evidence, CCPA evidence, or operational context.
The controlling business definition uses annual gross revenue in excess of the inflation-adjusted threshold; CPPA materials identify the adjusted amount.
annual gross revenues in excess of
2
Section 2
Evidence that can be reused only after relabeling
A data inventory can support both a GDPR assessment and a California assessment, but the labels matter. Under GDPR, records of processing activities identify controllers, processors, purposes, categories of data subjects and personal data, recipients, transfers, erasure time limits, and security measures where applicable.
A shared rights-request queue can also be useful, but it must preserve jurisdiction-specific clocks and exceptions. GDPR generally requires action without undue delay and within one month, subject to a possible two-month extension for complexity or volume. California delete, correct, and know requests generally require confirmation within 10 business days and a substantive response within 45 calendar days, subject to a possible 45-day extension.
Mark each evidence item with the legal source it supports.
Keep a GDPR lawful-basis field separate from California notice, sale, sharing, sensitive-information, and opt-out fields.
Acknowledge Global Privacy Control and other qualifying opt-out preference signals where California rules require them; do not treat a cookie preference alone as proof that the request reached every relevant sale or sharing flow.
Retain the mapping that shows which parts of a GDPR DPIA were reused in a California risk assessment and which California-specific elements were added.
Supports California consumer-rights categories and the general 10-business-day confirmation and 45-day response timing.
3
Section 3
Account for California rules effective in 2026
California regulations effective 1 January 2026 added requirements for certain businesses to conduct risk assessments and annual cybersecurity audits and gave consumers access and opt-out rights for specified uses of automated decisionmaking technology. The trigger and required content come from California rules, not GDPR Article 35.
A business using covered automated decisionmaking technology for a significant decision must meet the Article 11 requirements by 1 January 2027. Processing started before 1 January 2026 and continuing after that date may require a documented risk assessment by 31 December 2027. The regulations contain separate phased cybersecurity-audit and risk-assessment submission dates.
Inventory California significant-decision uses of automated decisionmaking technology and identify the pre-use notice, access, and opt-out steps that apply.
Determine whether the business meets the California risk-assessment or cybersecurity-audit trigger; do not assume a GDPR DPIA trigger answers that question.
Keep GDPR's 72-hour supervisory-authority breach clock, EU fine tiers, and Chapter V transfer mechanisms out of California deadline, penalty, and transfer fields.
Use the current CPPA regulations and implementation dates when planning 2026-2030 work.
Supports the GDPR international-transfer safeguard context for SCCs.
Standard Contractual Clauses
4
Section 4
Run one consumer request through the correct rule set
Start from the request the person made, not from the name of the portal that received it. A GDPR access request and a California request to know can enter the same queue, but they differ in scope, verification, response content, timing, extension rules, exceptions, and downstream instructions. Sale or sharing opt-outs, sensitive-information limits, and qualifying opt-out preference signals follow different California handling rules again.
Record the jurisdiction asserted, the person's relationship to the organization, the right exercised, the intake method, receipt time, identity or authority checks, systems searched, exception relied on, response, extension notice, downstream instruction, and completion evidence. If more than one regime may apply, create linked findings rather than forcing the request into one legal label.
Route GDPR requests by data-subject right and controller responsibility; route California requests by consumer right and the business, service-provider, contractor, or third-party role involved.
For delete, correct, and know requests, preserve California's 10-business-day confirmation and 45-calendar-day response fields, including any extension notice.
For sale or sharing opt-outs and sensitive-information limit requests, record when the request reached each relevant system and whether downstream recipients were instructed where required.
Keep denial and exception reasoning tied to the applicable rule. An exception under one regime does not answer the other.
Official guidance on California rights, intake methods, opt-out preference signals, response times, and common denial grounds.
5
Section 5
Test common overlap scenarios without merging the laws
For an EU and California customer account, reuse identity, system, recipient, retention, and security facts. Then issue separate findings: GDPR scope, controller or processor role, purpose, , notice, rights, transfer, and breach controls on one side; CCPA business or recipient role, collection purpose, notice, sale, sharing, sensitive-information, request, contract, and opt-out controls on the other.
For advertising technology, document each data flow rather than assigning one label to the vendor. A recipient may be a GDPR processor for one instructed service and a controller for another purpose. California service-provider or contractor treatment also depends on the statutory and contractual restrictions; a vendor label alone does not establish the role.
For automated decisions, assess GDPR Article 22 and DPIA questions separately from California ADMT rights and risk-assessment triggers. Human review matters under both regimes, but the definitions, thresholds, exceptions, consumer rights, evidence, and implementation dates are not interchangeable.
Customer account: one factual map, two scope and rights findings.
Advertising flow: classify every recipient, purpose, sale, sharing, instruction, and contract restriction.
Automated decision: record the input personal information, output, human involvement, effect, notice, rights path, assessment trigger, and effective date.
Incident: use the GDPR personal-data-breach test and notification clocks only for GDPR; assess California security, notification, remedy, and enforcement rules under their own authorities.
The controlling business definition uses annual gross revenue in excess of the inflation-adjusted threshold; CPPA materials identify the adjusted amount.