EU GDPR vs California CCPA

GDPR applies to processing in the context of an EU establishment and can also apply to non-EU controllers or processors that offer goods or services to people in the Union or monitor their behaviour in the Union.

The CCPA applies to qualifying for-profit businesses that do business in California and meet at least one threshold: $26.625 million in preceding-year gross annual revenue, personal information of at least 100,000 California residents or households bought, sold, or shared, or at least 50% of annual revenue from selling or sharing California residents' personal information. It also imposes obligations on service providers, contractors, and other recipients.

Run GDPR Article 3 for EU processing facts, then run the California entity, activity, threshold, and exclusion tests instead of copying the GDPR scope answer.

GDPR assigns duties to controllers, processors, joint controllers, representatives where applicable, and DPOs where required; processor processing must follow controller instructions unless Union or Member State law requires otherwise.

CCPA rules distinguish businesses, service providers, contractors, third parties, and certain other covered entities, each with different obligations.

Do not map GDPR controller or processor labels directly to California role labels without California authority.

GDPR processing needs an Article 6 legal basis such as consent, contract, legal obligation, vital interests, public task, or legitimate interests; consent must be demonstrable and withdrawable.

CCPA focuses on purpose limitation, reasonable expectations, notice, and consumer choice rights such as opt-out of sale/sharing and limit of sensitive personal information, rather than a GDPR-style Article 6 lawful-basis test.

Keep GDPR lawful-basis analysis separate from California purpose, notice, sale, sharing, limit, and opt-out analysis.

GDPR Articles 12 to 22 cover transparent communications and rights such as access, rectification, erasure, restriction, portability, objection, and safeguards for certain automated decisions; responses are due without undue delay and within one month, with a limited extension path.

CCPA gives consumers rights to know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and obtain equal treatment, and businesses generally must confirm within 10 business days and respond within 45 days, with a possible 45-day extension.

A shared request portal may be practical, but the queue must preserve the source, right type, response clock, and exception logic for each regime.

GDPR Article 30 records identify the controller or processor, purposes, data-subject and personal-data categories, recipient categories, third-country transfers, erasure time limits where possible, and security measures where possible.

CCPA records and privacy disclosures can include categories of personal information, categories of sources, categories of third parties, sale/share disclosures, request metrics, and response logs, plus California-specific notices and request-processing records.

Reuse inventories only after each field is tagged as GDPR evidence, California evidence, or shared operational context.

GDPR Article 32 requires risk-appropriate technical and organisational security measures. Article 33 requires supervisory-authority notification for notifiable personal data breaches without undue delay and, where feasible, not later than 72 hours after awareness.

California timing depends on the right: delete, correct, and know requests generally require confirmation within 10 business days and a response within 45 calendar days, with a possible 45-day extension. Sale/sharing opt-outs and sensitive-information limit requests generally must be acted on within 15 business days. Covered ADMT uses follow their own notice, access, opt-out, and compliance dates.

Calendar the GDPR breach clock separately and do not use it as a California deadline.

GDPR supervisory authorities have corrective powers, and Article 83 sets administrative fine factors and upper tiers up to EUR 20,000,000 or 4% of total worldwide annual turnover for specified infringements.

The California Privacy Protection Agency can investigate, audit, and enforce the CCPA, and California law also includes civil penalties and other remedies for certain violations.

Do not combine GDPR administrative-fine tiers with California penalty statements in one unsourced risk score.

GDPR requires a DPIA before processing likely to result in high risk, including systematic extensive automated evaluation with legal or similarly significant effects, large-scale special-category or criminal-offence data processing, and large-scale systematic monitoring of publicly accessible areas.

California regulations effective 1 January 2026 require risk assessments and cybersecurity audits from businesses that meet the respective triggers. A risk assessment prepared for another law may be used only if it meets the California requirements or is supplemented.

A GDPR DPIA may contain facts useful to another review, but it should not be labeled as California compliance evidence without California authority.

GDPR Chapter V governs transfers of personal data to third countries or international organisations, including adequacy decisions, appropriate safeguards such as SCCs, binding corporate rules, and derogations for specific situations.

If a team is choosing where to start, use GDPR first for EU data flows and California CCPA/CPRA first when the business activity turns on California consumer rights, CCPA notices, opt-out handling, or California-specific request timing.

Keep SCCs, transfer impact assessments, and adequacy references in the GDPR evidence set unless a California source says they answer a California requirement.