The General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), are two of the most influential privacy frameworks for organisations operating internationally. Although both give individuals greater control over their personal information, they differ significantly in their scope, legal foundations, consent requirements, consumer rights, breach obligations, enforcement mechanisms, and compliance responsibilities. This guide compares GDPR and CCPA requirements to help organisations understand where the frameworks overlap, where they differ, and how to build a privacy programme that addresses both.
Side-by-side: GDPR vs CCPA
| Dimension | ๐ช๐บ GDPR | ๐บ๐ธ CCPA |
|---|---|---|
| Jurisdiction | European Union / EEA framework | California, United States |
| Primary law | Regulation (EU) 2016/679 | California Consumer Privacy Act, as amended |
| Effective date | 25 May 2018 | 1 January 2020; major CPRA amendments effective 1 January 2023 |
| Regulatory model | Comprehensive data protection regulation | Consumer privacy and data protection law |
| Primary regulator | EU/EEA supervisory authorities and EDPB | California Privacy Protection Agency and California Attorney General |
| Who is covered? | Controllers/processors meeting GDPR territorial or establishment criteria | Businesses meeting CCPA applicability requirements |
| Legal basis | A lawful basis is required for processing | No equivalent six-basis framework |
| Consent | One of several lawful bases; stricter requirements in specific situations | Primarily relevant to certain opt-in requirements and specific uses |
| Sale/sharing opt-out | No direct CCPA-style sale/share framework | Consumers can opt out of sale or sharing |
| Sensitive information | Special-category data receives enhanced protection | Sensitive personal information receives additional controls |
| Data subject/consumer rights | Broad rights including access, rectification, erasure and portability | Rights including know, delete, correct, opt out, limit and non-discrimination |
| Breach notification | Supervisory authority notification generally within 72 hours when required | California breach laws generally require notification without unreasonable delay / in the most expedient time possible |
| DPO | Required in specified circumstances | No general CCPA DPO requirement |
| Local representative | Article 27 representative may be required for certain non-EU organisations | No general CCPA equivalent |
| Cross-border transfers | Subject to GDPR Chapter V requirements | No equivalent comprehensive CCPA transfer mechanism |
| Private litigation | Data subjects may seek compensation under GDPR Article 82 | Private right of action is principally associated with certain data breaches |
| Maximum GDPR administrative fine | Up to โฌ20 million or 4% of worldwide annual turnover, whichever is higher, for specified infringements | Administrative penalties and statutory damages depend on the applicable provision and circumstances |
What Is the GDPR?
The General Data Protection Regulation (GDPR) is the European Union's comprehensive data protection framework. It governs the processing of personal data and establishes obligations for organisations acting as controllers and processors.
The GDPR can apply to organisations outside the EU where the requirements of its territorial scope are met, including certain activities involving offering goods or services to individuals in the EU or monitoring their behaviour.
The GDPR is built around principles such as lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability.
What Is the CCPA?
The California Consumer Privacy Act (CCPA) provides California consumers with specific rights over their personal information and imposes obligations on businesses that fall within its scope.
The CCPA was amended by the California Privacy Rights Act (CPRA), which introduced additional consumer rights and created the California Privacy Protection Agency (CPPA).
The current CCPA framework includes requirements concerning transparency, consumer requests, sale and sharing of personal information, sensitive personal information, opt-out preference signals and other privacy controls.
The CPPA's current regulations include requirements effective from 1 January 2026, including updated CCPA rules and requirements relating to risk assessments, cybersecurity audits and automated decisionmaking technology for certain covered businesses.
GDPR vs CCPA: Key Differences
1. Territorial Scope
GDPR
The GDPR can apply to organisations established inside or outside the EU when the conditions in Article 3 are satisfied.
This can include organisations outside the EU that:
- Offer goods or services to individuals in the EU
- Monitor the behaviour of individuals in the EU
- Operate through an establishment in the EU
The applicability analysis should therefore be based on the organisation's activities and the GDPR's territorial-scope requirements.
CCPA
The CCPA applies to businesses that meet the statutory definition and applicable thresholds. It is not a general privacy law applicable to every organisation processing information about California residents.
Applicability depends on factors including the organisation's business activities, revenue and the volume or nature of California consumers' personal information.
Key difference: GDPR is structured around territorial applicability and roles such as controller and processor, while CCPA applicability focuses on covered businesses and statutory thresholds.
2. Legal Basis for Processing
One of the biggest differences between GDPR and CCPA is the concept of lawful processing.
GDPR
Organisations must identify an appropriate legal basis for each processing activity under Article 6, such as:
- Consent
- Contract
- Legal obligation
- Vital interests
- Public task
- Legitimate interests
Additional conditions apply when processing special-category data.
CCPA
The CCPA does not use the GDPR's six-lawful-basis model.
Instead, it focuses heavily on transparency, consumer rights, restrictions on certain uses and disclosures, and the ability to opt out of activities such as the sale or sharing of personal information.
3. Consent and Opt-Out
GDPR
Consent is one possible lawful basis, but it is not automatically required for every processing activity.
Where consent is used, it must satisfy GDPR requirements, including being freely given, specific, informed and unambiguous.
CCPA
The CCPA places significant emphasis on consumer choice and opt-out rights.
Consumers may have the right to opt out of:
- Sale of personal information
- Sharing of personal information for cross-context behavioural advertising
- Certain uses of sensitive personal information
- Certain automated decisionmaking activities where applicable
California's framework also recognises opt-out preference signals such as the Global Privacy Control (GPC) in applicable circumstances.
4. Consumer and Data Subject Rights
Both frameworks provide individuals with substantial privacy rights, but the terminology and mechanisms differ.
GDPR Rights
Depending on the circumstances, individuals may have rights to:
- Access personal data
- Rectify inaccurate data
- Erase personal data
- Restrict processing
- Object to processing
- Data portability
- Withdraw consent
- Rights relating to automated decision-making and profiling
CCPA Rights
California consumers may have rights including:
- Right to know
- Right to delete
- Right to correct
- Right to opt out of sale or sharing
- Right to limit certain uses and disclosures of sensitive personal information
- Right to opt out of certain automated decisionmaking activities where applicable
- Right to non-discrimination
The California Attorney General confirms that the CCPA gives consumers rights concerning access to information, deletion, opt-out of sale or sharing and non-discrimination.
5. Sensitive Personal Information
GDPR
GDPR Article 9 establishes enhanced protection for special categories of personal data, including information relating to areas such as health, biometric data used for identification, genetic data, political opinions and religious or philosophical beliefs.
Processing generally requires both an Article 6 legal basis and an applicable Article 9 condition.
CCPA
The CCPA separately defines sensitive personal information and provides consumers with rights concerning certain uses and disclosures of such information.
The California framework therefore approaches sensitive information differently from the GDPR's special-category-data model.
6. Data Breach Notification
GDPR
Where a personal data breach is likely to result in a risk to individuals' rights and freedoms, the controller generally must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach.
Where a breach is likely to result in a high risk to individuals, affected individuals may also need to be informed.
CCPA / California Breach Law
California breach notification requirements operate through California's data breach notification framework and related privacy provisions rather than a universal CCPA 72-hour rule.
Covered organisations should assess the incident against the applicable California requirements and provide notification within the legally required timeframe.
Key difference: GDPR establishes a specific 72-hour supervisory-authority notification framework for qualifying breaches; California uses a different statutory breach-notification framework.
7. Data Protection Officers
GDPR
A Data Protection Officer may be mandatory in circumstances specified by Article 37, including certain organisations whose core activities involve regular and systematic monitoring on a large scale or large-scale processing of special categories of data.
CCPA
The CCPA does not impose a general requirement for every covered business to appoint a GDPR-style Data Protection Officer.
However, organisations may need appropriate privacy, security, risk assessment and governance functions depending on their activities and obligations.
8. Privacy Representatives
GDPR
Certain organisations located outside the EU may need to appoint an EU Representative under Article 27 when Article 27 applies.
The representative can serve as a contact point for supervisory authorities and individuals regarding processing activities.
CCPA
The CCPA does not have a direct equivalent to the GDPR Article 27 representative requirement.
However, international businesses may still require appropriate California privacy governance, consumer-request handling and regulatory coordination.
9. Cross-Border Data Transfers
GDPR
International transfers of personal data outside the EU/EEA are governed by Chapter V of the GDPR.
Depending on the destination and circumstances, organisations may rely on mechanisms such as:
- Adequacy decisions
- Standard Contractual Clauses
- Binding Corporate Rules
- Specific derogations where applicable
CCPA
The CCPA does not establish a comprehensive cross-border transfer regime equivalent to GDPR Chapter V.
However, organisations must still consider contractual, security, transparency, vendor-management and other applicable legal requirements when personal information is transferred or accessed internationally.
10. Privacy Notices and Transparency
Both GDPR and CCPA require organisations to provide meaningful information about their processing activities.
GDPR
GDPR privacy notices typically address:
- Identity and contact details of the controller
- Purposes of processing
- Legal bases
- Categories of personal data
- Recipients
- International transfers
- Retention periods
- Data subject rights
- Complaint rights
- Automated decision-making where applicable
CCPA
CCPA privacy disclosures typically address:
- Categories of personal information collected
- Purposes for collection and use
- Categories of sources
- Categories of recipients
- Consumer rights
- Sale/sharing disclosures
- Sensitive personal information disclosures
- Opt-out mechanisms
11. Penalties and Enforcement
GDPR
For certain serious infringements, GDPR administrative fines can reach โฌ20 million or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher.
Enforcement is carried out by national supervisory authorities, coordinated through the European Data Protection Board.
CCPA
CCPA enforcement is handled by the California Privacy Protection Agency (CPPA) and the California Attorney General.
The CCPA contains administrative penalty provisions and a limited private right of action for certain data breaches. Penalty amounts and statutory damages depend on the applicable provision and circumstances.
The CPPA currently publishes the CCPA framework, regulations and monetary thresholds, including thresholds effective from 2025 and subsequent regulatory updates.
GDPR vs CCPA: Which Is More Strict?
It is not always accurate to describe one framework as universally "stricter."
The GDPR generally imposes a broader accountability framework, including:
- Legal-basis analysis
- Records of processing
- Data protection impact assessments in applicable cases
- Data protection officers in defined circumstances
- International transfer requirements
- Detailed controller and processor obligations
- Supervisory-authority oversight
The CCPA, meanwhile, has a particularly strong focus on consumer transparency, sale/sharing opt-outs, sensitive personal information, consumer requests and California-specific privacy controls.
Organisations operating internationally should therefore assess both frameworks rather than assuming compliance with one automatically satisfies the other.
GDPR vs CCPA: Can One Privacy Programme Cover Both?
Yes-but the programme should be designed around a common privacy control framework with jurisdiction-specific requirements layered on top.
A unified programme can include:
Data Inventory
Identify:
- What personal information is collected
- Where it is stored
- Why it is processed
- Who receives it
- How long it is retained
- Where it is transferred
Privacy Rights Management
Create a central process for handling:
- GDPR data subject requests
- California consumer requests
- Identity verification
- Request tracking
- Response deadlines
- Exceptions and legal holds
Consent & Preference Management
Manage:
- GDPR consent requirements
- Cookie and tracking preferences
- CCPA sale/sharing opt-outs
- Global Privacy Control signals
- Sensitive-information preferences
Vendor & Third-Party Management
Map:
- Processors
- Service providers
- Contractors
- Advertising partners
- Analytics providers
- Data-sharing relationships
Incident Response
Develop a unified breach response process that identifies:
- Applicable jurisdiction
- Notification threshold
- Regulatory notification requirements
- Consumer notification requirements
- Evidence and documentation requirements
Regulatory Monitoring
Privacy programmes should continuously monitor changes to both EU and California requirements.
The CPPA's current regulatory framework includes updates effective from 1 January 2026, making ongoing regulatory monitoring particularly important for organisations subject to California privacy law.
Frequently asked questions
Do I need to comply with both GDPR and CCPA?
You may need to comply with both if your organisation meets the GDPR's territorial-scope requirements and is also a business covered by the CCPA. The two frameworks overlap in areas such as transparency, access and deletion, but their requirements are not identical.
Is CCPA the same as GDPR?
No. Both are comprehensive privacy frameworks with overlapping concepts, but they use different regulatory structures. GDPR is based on data protection principles, lawful bases and controller/processor obligations, while CCPA focuses heavily on California consumer rights, transparency and opt-out mechanisms.
Does CCPA require consent like GDPR?
Not generally. CCPA does not use GDPR's lawful-basis framework. However, specific CCPA requirements may require consent or opt-in mechanisms in particular circumstances, including certain requirements involving minors.
Does CCPA have a 72-hour breach notification rule?
No. The CCPA should not be presented as having a universal 72-hour breach notification deadline equivalent to GDPR Article 33. California breach notification requirements operate under applicable California law and should be assessed based on the nature and circumstances of the incident.
Does CCPA require a Data Protection Officer?
No general CCPA requirement requires every covered business to appoint a GDPR-style DPO. However, organisations should establish appropriate privacy governance and accountability functions based on their obligations and risk profile.
Does CCPA require an Article 27 representative?
No. CCPA does not contain a direct equivalent to the GDPR Article 27 EU Representative requirement.
Can GDPR compliance help with CCPA compliance?
Yes. A mature GDPR programme can provide a strong foundation for CCPA compliance because both frameworks require transparency, privacy rights management, data governance and accountability. However, additional California-specific controls are required.
Which businesses should consider a GDPR and CCPA compliance assessment?
A combined assessment can be particularly valuable for SaaS companies, technology companies, e-commerce businesses, advertising and marketing platforms, AI companies, healthcare technology providers, financial technology businesses, global retailers, digital platforms, and companies processing consumer data across multiple jurisdictions.
GDPR & CCPA Compliance with RegulatoryBridge
Managing GDPR and CCPA requirements separately can create duplicated processes, inconsistent privacy notices and fragmented consumer-request workflows.
RegulatoryBridge helps organisations build a coordinated global privacy programme across jurisdictions.
Our support can include:
- GDPR compliance assessments
- CCPA / CPRA compliance assessments
- Data mapping and inventory
- Privacy notice reviews
- Data subject and consumer request workflows
- Consent and preference management
- Cookie and tracking compliance
- Vendor and processor assessments
- International data transfer assessments
- Breach response planning
- Privacy governance and accountability
- Regulatory monitoring
- Cross-border privacy representation
- Ongoing compliance support
Cover GDPR and CCPA under one programme.
Map controls once, comply twice. RegulatoryBridge gives you a single DSAR pipeline, single DPO, single breach runbook - covering both frameworks.