---
title: "EU GDPR vs California CCPA: Evidence Reuse Boundaries"
canonical_url: "https://www.sorena.io/artifacts/eu/general-data-protection-regulation/gdpr-vs-ccpa"
source_url: "https://www.sorena.io/artifacts/eu/general-data-protection-regulation/gdpr-vs-ccpa"
author: "Sorena AI"
description: "Identify which GDPR privacy records may help a California workstream and which CCPA/CPRA scope, rights, contract, timing, and enforcement questions need California-specific support."
published_at: "2026-05-09"
updated_at: "2026-07-16"
keywords:
  - "EU GDPR"
  - "GDPR"
  - "CCPA"
  - "CPRA"
  - "lawful basis"
  - "RoPA"
  - "DPIA"
  - "SCC"
  - "personal data breach"
---
**[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform

[Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io)

---

# EU GDPR vs California CCPA: Evidence Reuse Boundaries

Identify which GDPR privacy records may help a California workstream and which CCPA/CPRA scope, rights, contract, timing, and enforcement questions need California-specific support.

*Artifact Guide* *EU*

## EU GDPR vs California CCPA

Use this GDPR-first boundary guide to decide which privacy evidence can support both workstreams and which conclusions must remain jurisdiction-specific.

Do not treat a GDPR lawful-basis record, RoPA, DPIA, SCC file, or rights workflow as proof of CCPA/CPRA compliance. Validate California scope, notices, rights, contracts, timing, and enforcement against California-specific sources.

This page explains the GDPR side in detail and marks where a California-specific legal source is still required. It is an evidence-reuse boundary, not a substitute for a complete CCPA/CPRA applicability or implementation guide.

## EU GDPR vs California CCPA: what these cited sources can and cannot prove

Use the left column for official source GDPR implementation facts. Use the right column only as a source-limit warning unless separate California CCPA/CPRA sources are added.

- **EU GDPR**: Based on the GDPR text and EU GDPR guidance available in the cited sources.
- **California CCPA/CPRA**: Based on California CPPA regulations and FAQs available in the California cited sources, covering notice, opt-out, limit, access, verification, service-provider, and enforcement rules.

| Dimension | EU GDPR | California CCPA/CPRA | Operational implication | Sources |
| --- | --- | --- | --- | --- |
| Scope boundary | GDPR applies to processing in the context of an EU establishment and can also apply to non-EU controllers or processors that offer goods or services to people in the Union or monitor their behaviour in the Union. | The CCPA applies to qualifying for-profit businesses that do business in California and meet statutory thresholds, and it also imposes separate obligations on service providers, contractors, and third parties. | Run GDPR Article 3 first for EU processing facts, then run a separate California-source check for CCPA applicability and thresholds instead of copying the GDPR scope answer. | [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Supports separating GDPR scope analysis from comparator claims.<br>[Frequently Asked Questions (FAQs)](https://cppa.ca.gov/faq.html?ref=sorena.io) - Explains who must comply with the CCPA and the law's scope in California. |
| Covered actors | GDPR assigns duties to controllers, processors, joint controllers, representatives where applicable, and DPOs where required; processor processing must follow controller instructions unless Union or Member State law requires otherwise. | CCPA rules distinguish businesses, service providers, contractors, third parties, and certain other covered entities, each with different obligations. | Do not map GDPR controller or processor labels directly to California role labels without California authority. | [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Supports keeping GDPR role assignments tied to GDPR role definitions.<br>[Frequently Asked Questions (FAQs)](https://cppa.ca.gov/faq.html?ref=sorena.io) - Explains that the CCPA applies to businesses, service providers, contractors, and third parties as defined by California law. |
| Trigger | GDPR processing needs an Article 6 legal basis such as consent, contract, legal obligation, vital interests, public task, or legitimate interests; consent must be demonstrable and withdrawable. | CCPA focuses on purpose limitation, reasonable expectations, notice, and consumer choice rights such as opt-out of sale/sharing and limit of sensitive personal information, rather than a GDPR-style Article 6 lawful-basis test. | Keep GDPR lawful-basis analysis separate from California choice or opt-out analysis until California sources are added. | [Data Protection Commission guidance on legal bases for processing personal data](https://www.dataprotection.ie/en/dpc-guidance/guidance-legal-bases-processing-personal-data?ref=sorena.io) - Supports using a dedicated GDPR lawful-basis field.<br>[California Consumer Privacy Act Regulations (March 2023)](https://cppa.ca.gov/regulations/consumer_privacy_act.html?ref=sorena.io) - Explains California's purpose limitation, reasonable necessity, consent, and consumer choice rules. |
| Core obligations | GDPR Articles 12 to 22 cover transparent communications and rights such as access, rectification, erasure, restriction, portability, objection, and safeguards for certain automated decisions; responses are due without undue delay and within one month, with a limited extension path. | CCPA gives consumers rights to know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and obtain equal treatment, and businesses generally must confirm within 10 business days and respond within 45 days, with a possible 45-day extension. | A shared request portal may be practical, but the queue must preserve the source, right type, response clock, and exception logic for each regime. | [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Supports keeping GDPR rights clocks and exception records distinct.<br>[Frequently Asked Questions (FAQs)](https://cppa.ca.gov/faq.html?ref=sorena.io) - Summarizes California consumer rights and response times. |
| Evidence record | GDPR Article 30 records identify the controller or processor, purposes, data-subject and personal-data categories, recipient categories, third-country transfers, erasure time limits where possible, and security measures where possible. | CCPA records and privacy disclosures can include categories of personal information, categories of sources, categories of third parties, sale/share disclosures, request metrics, and response logs, plus California-specific notices and request-processing records. | Reuse inventories only after each field is tagged as GDPR evidence, California evidence, or shared operational context. | [Data Protection Commission guidance on Records of Processing Activities under Article 30 GDPR](https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Records%20of%20Processing%20Activities%20%28RoPA%29%20under%20Article%2030%20GDPR.pdf?ref=sorena.io) - Supports tagging RoPA content as GDPR accountability evidence.<br>[California Consumer Privacy Act Regulations (March 2023)](https://cppa.ca.gov/regulations/consumer_privacy_act.html?ref=sorena.io) - Explains California privacy policy and notice content, including categories of personal information and sources. |
| Timing and deadlines | GDPR Article 32 requires risk-appropriate technical and organisational security measures. Article 33 requires supervisory-authority notification for notifiable personal data breaches without undue delay and, where feasible, not later than 72 hours after awareness. | CCPA request timing is more specific to the right being exercised: delete, correct, know, and ADMT appeals generally get a 10-business-day acknowledgement and a 45-day response period; opt-out of sale/sharing and limit requests generally must be handled within 15 business days. | Calendar the GDPR breach clock separately and do not use it as a California deadline. | [EDPB notify a data breach page](https://www.edpb.europa.eu/notify-data-breach_en?ref=sorena.io) - Supports the Article 33 notification condition and DPA routing context.<br>[California Consumer Privacy Act Regulations (March 2023)](https://cppa.ca.gov/regulations/consumer_privacy_act.html?ref=sorena.io) - Sets California request timing and processing deadlines.<br>[Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Supports the GDPR 72-hour notification clock and breach documentation requirement. |
| Enforcement | GDPR supervisory authorities have corrective powers, and Article 83 sets administrative fine factors and upper tiers up to EUR 20,000,000 or 4% of total worldwide annual turnover for specified infringements. | The California Privacy Protection Agency can investigate, audit, and enforce the CCPA, and California law also includes civil penalties and other remedies for certain violations. | Do not combine GDPR administrative-fine tiers with California penalty statements in one unsourced risk score. | [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Supports source-specific penalty labels.<br>[Frequently Asked Questions (FAQs)](https://cppa.ca.gov/faq.html?ref=sorena.io) - Explains that the Agency can investigate, audit, and bring enforcement actions. |
| Overlap and reuse | GDPR requires a DPIA before processing likely to result in high risk, including systematic extensive automated evaluation with legal or similarly significant effects, large-scale special-category or criminal-offence data processing, and large-scale systematic monitoring of publicly accessible areas. | CCPA also has risk-assessment and cybersecurity-audit requirements for certain businesses, and a GDPR DPIA can be reused only if the California-specific required information is added and the California scope is documented. | A GDPR DPIA may contain facts useful to another review, but it should not be labeled as California compliance evidence without California authority. | [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Supports requiring source-specific labels for DPIA evidence.<br>[California Consumer Privacy Act Regulations (March 2023)](https://cppa.ca.gov/regulations/consumer_privacy_act.html?ref=sorena.io) - Includes California risk assessment and cybersecurity audit rules. |
| Practical decision rule | GDPR Chapter V governs transfers of personal data to third countries or international organisations, including adequacy decisions, appropriate safeguards such as SCCs, binding corporate rules, and derogations for specific situations. | If a team is choosing where to start, use GDPR first for EU data flows and California CCPA/CPRA first when the business activity turns on California consumer rights, CCPA notices, opt-out handling, or California-specific request timing. | Keep SCCs, transfer impact assessments, and adequacy references in the GDPR evidence set unless a California source says they answer a California requirement. | [European Commission Standard Contractual Clauses page](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en?ref=sorena.io) - Supports SCCs as a GDPR international-transfer safeguard resource.<br>[Frequently Asked Questions (FAQs)](https://cppa.ca.gov/faq.html?ref=sorena.io) - Explains California rights, business responsibilities, and how to exercise them.<br>[Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Chapter V supports keeping GDPR transfer safeguards distinct. |

Sources for Scope boundary - EU GDPR:

- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Article 3 grounds GDPR establishment, offering, and monitoring scope.
  - Quote: "offering of goods or services"

Sources for Scope boundary - California CCPA/CPRA:

- [Frequently Asked Questions (FAQs)](https://cppa.ca.gov/faq.html?ref=sorena.io) - Explains who must comply with the CCPA and the law's scope in California.
  - Quote: "The CCPA applies to for-profit businesses"

Sources for Scope boundary - operational implication:

- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Supports separating GDPR scope analysis from comparator claims.
  - Quote: "Territorial scope"

Sources for Covered actors - EU GDPR:

- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds GDPR controller, processor, joint-controller, and processor-instruction duties.
  - Quote: "controller or processor"

Sources for Covered actors - California CCPA/CPRA:

- [Frequently Asked Questions (FAQs)](https://cppa.ca.gov/faq.html?ref=sorena.io) - Explains that the CCPA applies to businesses, service providers, contractors, and third parties as defined by California law.
  - Quote: "The CCPA applies to businesses, service providers, contractors, and third parties"

Sources for Covered actors - operational implication:

- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Supports keeping GDPR role assignments tied to GDPR role definitions.
  - Quote: "Processing under the authority"

Sources for Trigger - EU GDPR:

- [Data Protection Commission guidance on legal bases for processing personal data](https://www.dataprotection.ie/en/dpc-guidance/guidance-legal-bases-processing-personal-data?ref=sorena.io) - Supports the list of GDPR Article 6 legal bases and the need to identify the justification for processing.
  - Quote: "consent; contract; legal obligation"

Sources for Trigger - California CCPA/CPRA:

- [California Consumer Privacy Act Regulations (March 2023)](https://cppa.ca.gov/regulations/consumer_privacy_act.html?ref=sorena.io) - Explains California's purpose limitation, reasonable necessity, consent, and consumer choice rules.
  - Quote: "reasonably necessary and proportionate"

Sources for Trigger - operational implication:

- [Data Protection Commission guidance on legal bases for processing personal data](https://www.dataprotection.ie/en/dpc-guidance/guidance-legal-bases-processing-personal-data?ref=sorena.io) - Supports using a dedicated GDPR lawful-basis field.
  - Quote: "reason or justification"

Sources for Core obligations - EU GDPR:

- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds GDPR rights and the one-month response rule.
  - Quote: "within one month of receipt"

Sources for Core obligations - California CCPA/CPRA:

- [Frequently Asked Questions (FAQs)](https://cppa.ca.gov/faq.html?ref=sorena.io) - Summarizes California consumer rights and response times.
  - Quote: "Businesses must confirm receipt of your request within 10 business days"

Sources for Core obligations - operational implication:

- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Supports keeping GDPR rights clocks and exception records distinct.
  - Quote: "Articles 15 to 22"

Sources for Evidence record - EU GDPR:

- [Data Protection Commission guidance on Records of Processing Activities under Article 30 GDPR](https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Records%20of%20Processing%20Activities%20%28RoPA%29%20under%20Article%2030%20GDPR.pdf?ref=sorena.io) - Supports the Article 30 RoPA fields and accountability use.
  - Quote: "purposes of processing"

Sources for Evidence record - California CCPA/CPRA:

- [California Consumer Privacy Act Regulations (March 2023)](https://cppa.ca.gov/regulations/consumer_privacy_act.html?ref=sorena.io) - Explains California privacy policy and notice content, including categories of personal information and sources.
  - Quote: "Identification of the categories of sources from which the personal information is collected"

Sources for Evidence record - operational implication:

- [Data Protection Commission guidance on Records of Processing Activities under Article 30 GDPR](https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Records%20of%20Processing%20Activities%20%28RoPA%29%20under%20Article%2030%20GDPR.pdf?ref=sorena.io) - Supports tagging RoPA content as GDPR accountability evidence.
  - Quote: "demonstrate accountability"

Sources for Timing and deadlines - EU GDPR:

- [EDPB notify a data breach page](https://www.edpb.europa.eu/notify-data-breach_en?ref=sorena.io) - Supports the Article 33 notification condition and DPA routing context.
  - Quote: "unlikely to present any risk"

Sources for Timing and deadlines - California CCPA/CPRA:

- [California Consumer Privacy Act Regulations (March 2023)](https://cppa.ca.gov/regulations/consumer_privacy_act.html?ref=sorena.io) - Sets California request timing and processing deadlines.
  - Quote: "No later than 10 business days"

Sources for Timing and deadlines - operational implication:

- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Supports the GDPR 72-hour notification clock and breach documentation requirement.
  - Quote: "not later than 72 hours"

Sources for Enforcement - EU GDPR:

- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Article 83 grounds GDPR administrative fine factors and upper tiers.
  - Quote: "up to 20 000 000 EUR"

Sources for Enforcement - California CCPA/CPRA:

- [Frequently Asked Questions (FAQs)](https://cppa.ca.gov/faq.html?ref=sorena.io) - Explains that the Agency can investigate, audit, and bring enforcement actions.
  - Quote: "The Agency is tasked with enforcing the CCPA through administrative enforcement actions"

Sources for Enforcement - operational implication:

- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Supports source-specific penalty labels.
  - Quote: "Administrative fines"

Sources for Overlap and reuse - EU GDPR:

- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Article 35 grounds GDPR DPIA triggers and minimum DPIA content.
  - Quote: "likely to result in a high risk"

Sources for Overlap and reuse - California CCPA/CPRA:

- [California Consumer Privacy Act Regulations (March 2023)](https://cppa.ca.gov/regulations/consumer_privacy_act.html?ref=sorena.io) - Includes California risk assessment and cybersecurity audit rules.
  - Quote: "Risk Assessments"

Sources for Overlap and reuse - operational implication:

- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Supports requiring source-specific labels for DPIA evidence.
  - Quote: "Data protection impact assessment"

Sources for Practical decision rule - EU GDPR:

- [European Commission Standard Contractual Clauses page](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en?ref=sorena.io) - Supports SCCs as a GDPR international-transfer safeguard resource.
  - Quote: "Standard Contractual Clauses"

Sources for Practical decision rule - California CCPA/CPRA:

- [Frequently Asked Questions (FAQs)](https://cppa.ca.gov/faq.html?ref=sorena.io) - Explains California rights, business responsibilities, and how to exercise them.
  - Quote: "Businesses must generally designate at least two methods"

Sources for Practical decision rule - operational implication:

- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Chapter V supports keeping GDPR transfer safeguards distinct.
  - Quote: "transfer of personal data"

### How should teams use this comparison?

- Start with GDPR when the question is about EU establishment, lawful basis, rights handling, breach notification, or transfer safeguards.
- Start with California CCPA/CPRA when the question is about California consumer rights, CCPA notices, opt-out or limit links, request deadlines, or California audit and risk-assessment rules.
- Label shared artifacts by source: GDPR evidence, California evidence, or operational context.
- Escalate any row marked limited to the cited sources before using it in customer, regulator, audit, or board materials.

Sources for the practical decision rule:

- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Primary source for the official source GDPR side of the decision rule.
  - Quote: "accountability"
- [European Commission report on the EU-US Data Privacy Framework first periodic review](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/14379-EU-US-Data-Privacy-Framework-report-of-the-Commission-on-how-the-framework-is-functioning_en?ref=sorena.io) - Limited to cited sources California comparator context; not a source for detailed CCPA/CPRA obligations.
  - Quote: "comprehensive privacy laws"

## Use GDPR as the official source side of the comparison

The GDPR source text supports concrete implementation questions: whether personal data is processed, whether the controller or processor is established in the Union or targets or monitors people in the Union, which lawful basis applies, which rights and notices are required, and which records or safeguards must exist.

For the California side, the sources cited on this page support only a narrow comparator fact: a European Commission report says California was one of eight U.S. states with comprehensive privacy laws in application as of July 2024. Detailed CCPA/CPRA duties need a separate California source before they are used in an evidence pack.

- Separate GDPR scope from California scope before assigning a shared privacy control.
- Treat RoPA entries, lawful-basis analysis, DPIAs, SCC files, and breach records as GDPR evidence unless a California source is attached to the same record.
- Do not infer California request deadlines, opt-out duties, sensitive-data rules, contract terms, or enforcement amounts from GDPR sources.

Sources for this answer:

- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Grounds GDPR scope, definitions, principles, rights, controller and processor duties, transfers, supervisory authorities, remedies, and administrative fines.
- [European Commission report on the EU-US Data Privacy Framework first periodic review](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/14379-EU-US-Data-Privacy-Framework-report-of-the-Commission-on-how-the-framework-is-functioning_en?ref=sorena.io) - Grounds only the limited comparator fact that California was listed among U.S. states with comprehensive privacy laws in application as of July 2024.

## Evidence that can be reused only after relabeling

A data inventory can support both a GDPR assessment and a California assessment, but the labels matter. Under GDPR, records of processing activities identify controllers, processors, purposes, categories of data subjects and personal data, recipients, transfers, erasure time limits, and security measures where applicable.

A shared rights-request queue can also be useful, but GDPR response handling should remain tied to GDPR Articles 12 to 22 and the one-month response rule. This page does not establish California request timing or exceptions.

- Mark each evidence item with the legal source it supports.
- Keep a GDPR lawful-basis field separate from any California notice, sale, sharing, or opt-out field until California sources are attached.
- Retain rejected comparisons, such as a decision that a GDPR DPIA is not evidence of a CCPA/CPRA risk assessment without a separate California citation.

Sources for this answer:

- [Data Protection Commission guidance on Records of Processing Activities under Article 30 GDPR](https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Records%20of%20Processing%20Activities%20%28RoPA%29%20under%20Article%2030%20GDPR.pdf?ref=sorena.io) - Supports the GDPR record fields and the use of RoPA to demonstrate accountability.
- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Supports the GDPR one-month response rule for data-subject rights requests and the rights framework in Articles 12 to 22.

## GDPR facts that should not be converted into CCPA facts

GDPR requires a lawful basis for personal-data processing, supports special-category processing only under Article 9 conditions, requires risk-appropriate security measures, and uses a 72-hour supervisory-authority notification clock for notifiable personal data breaches.

Those are GDPR facts. They may be operationally useful when building a privacy program, but they do not prove a California CCPA/CPRA duty unless the California side is separately sourced.

- Do not call GDPR consent a California opt-out mechanism without a California source.
- Do not use the GDPR 72-hour breach clock as a California breach deadline.
- Do not use GDPR administrative-fine caps as California penalty figures.
- Do not treat SCCs or EU adequacy decisions as California transfer mechanisms.

Sources for this answer:

- [Data Protection Commission guidance on legal bases for processing personal data](https://www.dataprotection.ie/en/dpc-guidance/guidance-legal-bases-processing-personal-data?ref=sorena.io) - Supports the GDPR requirement to identify a legal basis for processing personal data.
- [EDPB notify a data breach page](https://www.edpb.europa.eu/notify-data-breach_en?ref=sorena.io) - Supports GDPR breach-notification routing and the Article 33 risk-based notification condition.
- [European Commission Standard Contractual Clauses page](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en?ref=sorena.io) - Supports the GDPR international-transfer safeguard context for SCCs.

*Recommended next step*

*Placement: before sources*

## Build a comparison with source-labeled evidence

Sorena can help turn this GDPR-first comparison into source-labeled scope findings, evidence requests, and gaps for a separate CCPA/CPRA review.

- [Open Research Copilot for GDPR](/solutions/research-copilot.md): Ask questions tied to cited sources about GDPR scope, lawful basis, rights, RoPA, breach notification, DPIAs, SCCs, and comparison gaps.
- [Talk through implementation](/contact.md): Review which GDPR evidence can be reused and which California facts need separate source support.

## Primary sources

- [Regulation (EU) 2016/679 (GDPR)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX%3A02016R0679-20160504&ref=sorena.io) - Primary source for the official source GDPR side of the decision rule.
  - Quote: "accountability"
- [Data Protection Commission guidance on legal bases for processing personal data](https://www.dataprotection.ie/en/dpc-guidance/guidance-legal-bases-processing-personal-data?ref=sorena.io) - Supports using a dedicated GDPR lawful-basis field.
  - Quote: "reason or justification"
- [Data Protection Commission guidance on Records of Processing Activities under Article 30 GDPR](https://www.dataprotection.ie/sites/default/files/uploads/2023-04/Records%20of%20Processing%20Activities%20%28RoPA%29%20under%20Article%2030%20GDPR.pdf?ref=sorena.io) - Supports tagging RoPA content as GDPR accountability evidence.
  - Quote: "demonstrate accountability"
- [EDPB notify a data breach page](https://www.edpb.europa.eu/notify-data-breach_en?ref=sorena.io) - Supports the Article 33 notification condition and DPA routing context.
  - Quote: "unlikely to present any risk"
- [European Commission Standard Contractual Clauses page](https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en?ref=sorena.io) - Supports SCCs as a GDPR international-transfer safeguard resource.
  - Quote: "Standard Contractual Clauses"
- [European Commission report on the EU-US Data Privacy Framework first periodic review](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/14379-EU-US-Data-Privacy-Framework-report-of-the-Commission-on-how-the-framework-is-functioning_en?ref=sorena.io) - Limited to cited sources California comparator context; not a source for detailed CCPA/CPRA obligations.
  - Quote: "comprehensive privacy laws"
- [Frequently Asked Questions (FAQs)](https://cppa.ca.gov/faq.html?ref=sorena.io) - Explains California rights, business responsibilities, and how to exercise them.
  - Quote: "Businesses must generally designate at least two methods"
- [California Consumer Privacy Act Regulations (March 2023)](https://cppa.ca.gov/regulations/consumer_privacy_act.html?ref=sorena.io) - Includes California risk assessment and cybersecurity audit rules.
  - Quote: "Risk Assessments"

## Related Topic Guides

- [Does the EU GDPR apply outside the EU under Article 3?](/artifacts/eu/general-data-protection-regulation/faq/territorial-scope.md): An official source GDPR Article 3 territorial-scope FAQ covering EU establishment, offering goods or services, monitoring behavior in the EU, and Article 27 representatives.
- [EU GDPR Applicability Test for Products, Vendors, and Data Flows](/artifacts/eu/general-data-protection-regulation/applicability-test.md): A concrete GDPR scope test for personal data, controller and processor roles, EU establishment, EU targeting or monitoring, special-category and child data, transfers, vendors, and evidence.
- [EU GDPR Article 30 RoPA Intake Workflow](/artifacts/eu/general-data-protection-regulation/ropa-intake-workflow.md): This GDPR Article 30 RoPA intake workflow helps capture controller and processor fields, owners, transfers, retention, security measures, and evidence before a processing activity goes live.
- [EU GDPR Article 6 Legal Bases FAQ](/artifacts/eu/general-data-protection-regulation/faq/legal-bases.md): FAQ on the six Article 6 GDPR lawful bases, consent caveats, legitimate interests, public-task and legal-obligation limits, and Article 9 special-category data.
- [EU GDPR Automated Decision-Making and Profiling: Article 22 Scope, Safeguards, and Evidence](/artifacts/eu/general-data-protection-regulation/automated-decision-making-and-profiling.md): GDPR guide to profiling and Article 22 decisions: scope, transparency, lawful basis, DPIA triggers, safeguards, human intervention, challenge rights, and evidence.
- [EU GDPR Breach Notification 72 Hours: Article 33 and 34 workflow](/artifacts/eu/general-data-protection-regulation/breach-notification-72-hours.md): Official source EU GDPR breach notification workflow covering awareness, 72-hour supervisory authority notices, processor escalation, high-risk data-subject communication, delay reasons, and evidence logs.
- [EU GDPR Breach Notification Workflow: 72-hour clock, risk assessment, and records](/artifacts/eu/general-data-protection-regulation/breach-notification-workflow.md): A concrete EU GDPR breach notification workflow for detecting and triaging incidents, starting the awareness clock, assessing risk, notifying authorities or data subjects, and keeping Article 33 records.
- [EU GDPR Checklist: scope, lawful basis, DSARs, DPIA, RoPA, transfers](/artifacts/eu/general-data-protection-regulation/checklist.md): This GDPR checklist helps review scope, lawful basis, notices, DSAR handling, DPIAs, RoPA, processor contracts, SCC transfers, breach notification, retention, security, and evidence.
- [EU GDPR Children and Special-Category Data Guide](/artifacts/eu/general-data-protection-regulation/children-and-special-categories.md): GDPR guide to children's consent and special-category data: Article 8 national age variation, Article 9 conditions, transparency, DPIA triggers, safeguards, and evidence.
- [EU GDPR Compliance Checklist: scope, rights, DPIA, RoPA, transfers](/artifacts/eu/general-data-protection-regulation/compliance.md): Practical EU GDPR compliance guide for mapping scope, lawful basis, notices, data-subject rights, DPIAs, RoPA, processor terms, breaches, transfers, retention, security, and penalties.
- [EU GDPR Controller, Processor, and Joint Controller Roles](/artifacts/eu/general-data-protection-regulation/controller-processor-and-joint-controller-roles.md): Classify GDPR controllers, processors, and joint controllers from actual decision-making, then document Article 26 allocation, Article 28 terms, instructions, and vendor evidence.
- [EU GDPR Data Subject Rights and DSAR Workflow](/artifacts/eu/general-data-protection-regulation/data-subject-rights-and-dsar-workflow.md): GDPR rights-request workflow for intake, identity checks, request scope, the one-month response clock, extensions, refusals, processor coordination, and evidence.
- [EU GDPR deadlines and compliance calendar](/artifacts/eu/general-data-protection-regulation/deadlines-and-compliance-calendar.md): GDPR operating calendar for rights-request timing, breach notification, DPIA and prior-consultation gates, transfer reviews, retention checks, and evidence.
- [EU GDPR DPIA and Prior Consultation Workflow](/artifacts/eu/general-data-protection-regulation/dpia-and-prior-consultation-workflow.md): Screen high-risk processing, run a GDPR Article 35 DPIA, record mitigation, and identify when Article 36 prior consultation is required.
- [EU GDPR DPIA and risk management under Articles 35 and 36](/artifacts/eu/general-data-protection-regulation/dpia-and-risk-management.md): EU GDPR DPIA guide covering Article 35 triggers and contents, CNIL and DPC PIA methods, residual risk, mitigation records, and prior consultation limits.
- [EU GDPR DSAR Exceptions: refusal, extensions, identity checks](/artifacts/eu/general-data-protection-regulation/faq/dsar-exceptions.md): FAQ on when EU GDPR controllers may extend, charge for, narrow, redact, or refuse a data subject access request under Articles 12 and 15.
- [EU GDPR DSAR Workflow: Intake, Clock, Rights, and Evidence](/artifacts/eu/general-data-protection-regulation/dsar-workflow.md): Run a GDPR DSAR workflow for intake, identity checks, rights scoping, one-month response timing, extensions, refusals, processor handoffs, and evidence records.
- [EU GDPR FAQ: scope, lawful basis, rights, DPIA, breaches, transfers](/artifacts/eu/general-data-protection-regulation/faq.md): Direct EU GDPR FAQ answers on scope, controller and processor roles, lawful basis, data subject rights, DPIAs, breach notification, international transfers, and Article 83 fine tiers.
- [EU GDPR International Transfers and SCCs: Chapter V evidence guide](/artifacts/eu/general-data-protection-regulation/international-transfers-and-sccs.md): GDPR Chapter V guide to adequacy decisions, SCCs, transfer assessments, supplementary measures, Article 49 derogations, and EU-US DPF checks.
- [EU GDPR Lawful Basis and Consent Guide](/artifacts/eu/general-data-protection-regulation/lawful-basis-and-consent.md): Focused GDPR guide to Article 6 lawful bases, consent conditions, legitimate interests, special category data, withdrawal, and evidence records.
- [EU GDPR Lawful Basis and LIA Workflow for Article 6(1)(f)](/artifacts/eu/general-data-protection-regulation/lawful-basis-and-lia-workflow.md): Assess GDPR legitimate interests with a purpose, necessity, balancing, Article 21 objection, and evidence-record workflow based on Article 6(1)(f).
- [EU GDPR Lead Supervisory Authority and One-Stop-Shop](/artifacts/eu/general-data-protection-regulation/lead-authority-and-one-stop-shop.md): How GDPR main establishment, cross-border processing, Article 56 lead authority competence, and Article 60 cooperation fit together.
- [EU GDPR LIA Template for Article 6(1)(f)](/artifacts/eu/general-data-protection-regulation/lia-template.md): This EU GDPR legitimate interests assessment template helps document Article 6(1)(f) purpose, necessity, balancing, safeguards, objection rights, and evidence.
- [EU GDPR penalties and fines: Article 83 tiers and evidence](/artifacts/eu/general-data-protection-regulation/penalties-and-fines.md): EU GDPR penalties and fines guide covering Article 83 fine tiers, assessment factors, Article 58 powers, and evidence records for controllers and processors.
- [EU GDPR Processor Contracts and Vendor Management | Article 28 Evidence Guide](/artifacts/eu/general-data-protection-regulation/processor-contracts-and-vendor-management.md): EU GDPR Article 28 guide for processor contracts, sub-processor controls, controller-processor role boundaries, vendor evidence, and SCC transfer clauses where applicable.
- [EU GDPR Record of Processing Activities Template: Article 30 RoPA Fields](/artifacts/eu/general-data-protection-regulation/record-of-processing-activities-template.md): Build a GDPR Article 30 record of processing activities with separate controller and processor fields for purposes, data categories, recipients, transfers, erasure time limits, and security measures.
- [EU GDPR Requirements: scope, rights, security, DPIA, RoPA, and transfers](/artifacts/eu/general-data-protection-regulation/requirements.md): Overview of core EU GDPR requirements covering scope, principles, lawful basis, notices, data-subject rights, processors, RoPA, security, breaches, DPIAs, and international transfers.
- [EU GDPR Retention and Erasure Schedule](/artifacts/eu/general-data-protection-regulation/retention-and-erasure-schedule.md): Build an EU GDPR retention and erasure schedule around storage limitation, Article 17 erasure grounds, Article 12 rights handling, Article 19 recipient notices, and Article 30 RoPA fields.
- [EU GDPR SCC Transfer Impact Assessment FAQ](/artifacts/eu/general-data-protection-regulation/faq/scc-transfer-impact-assessment.md): cited FAQ on when SCC transfer impact assessments are needed, what Clause 14 records, and when supplementary safeguards or transfer suspension are required.
- [EU GDPR Transfer TIA and SCC Workflow](/artifacts/eu/general-data-protection-regulation/transfer-tia-and-scc-workflow.md): A GDPR workflow for checking adequacy, selecting SCC modules, documenting transfer impact assessments, and recording supplementary measures for third-country transfers.
- [EU GDPR Transparency Notices: Articles 12, 13 and 14](/artifacts/eu/general-data-protection-regulation/transparency-notices.md): GDPR privacy-notice guide for Articles 12, 13, and 14: direct collection, other data sources, purposes, lawful bases, recipients, transfers, retention, rights, and timing.
- [EU GDPR vs Brazil LGPD: GDPR-led comparison and source gaps](/artifacts/eu/general-data-protection-regulation/gdpr-vs-lgpd.md): Compare EU GDPR duties with Brazil LGPD only where the available sources support the comparator, with GDPR rows for lawful basis, rights, breach, transfers, roles, and evidence.
- [EU GDPR vs ePrivacy Directive: personal data, cookies, consent, and communications](/artifacts/eu/general-data-protection-regulation/gdpr-vs-eprivacy.md): Compare the EU GDPR and ePrivacy Directive for personal data processing, consent and lawful basis, cookies and terminal access, electronic communications, and parallel compliance.
- [EU GDPR vs UK GDPR: Evidence and Transfer Boundaries](/artifacts/eu/general-data-protection-regulation/gdpr-vs-uk-gdpr.md): Compare EU GDPR obligations with UK GDPR transfer notes based on EU GDPR sources, covering scope, lawful basis, rights, accountability, records, DPIAs, security, and transfers.
- [GDPR processor vs controller: role boundaries and evidence](/artifacts/eu/general-data-protection-regulation/faq/processor-vs-controller.md): Decide whether a party is a GDPR controller, processor, or joint controller using purpose-and-means tests, Article 28 terms, Article 26 arrangements, and Article 30 records.
- [GDPR vs EU AI Act: privacy controls for AI systems](/artifacts/eu/general-data-protection-regulation/gdpr-vs-ai-act.md): Map the GDPR work that remains necessary when an AI system processes personal data, including lawful basis, notices, DPIAs, Article 22, rights, security, records, and transfers.
- [GDPR vs EU Data Act: personal data safeguards and source limits](/artifacts/eu/general-data-protection-regulation/gdpr-vs-data-act.md): Compare GDPR obligations with the EU Data Act only where the sources cited on this page support the fact pattern, with clear safeguards for personal data, rights, transfers, and accountability.
- [When does the EU GDPR require a DPIA?](/artifacts/eu/general-data-protection-regulation/faq/dpia-threshold.md): Answer the EU GDPR DPIA threshold question with Article 35 triggers, high-risk criteria, supervisory-authority list checks, and DPIA content requirements.
- [When does the GDPR 72-hour breach notification clock start?](/artifacts/eu/general-data-protection-regulation/faq/breach-awareness-clock.md): GDPR breach-awareness FAQ covering the Article 33 clock, processor escalation, delayed or phased notifications, risk assessment, and records to keep.


---

[Privacy Policy](https://www.sorena.io/privacy.md) | [Terms of Use](https://www.sorena.io/terms-of-use.md) | [DMCA](https://www.sorena.io/dmca.md) | [About Us](https://www.sorena.io/about-us.md)

(c) 2026 Sorena AB (559573-7338). All rights reserved.

Source: https://www.sorena.io/artifacts/eu/general-data-protection-regulation/gdpr-vs-ccpa.md