GDPR vs CCPA/CPRA: Scope, Rights and Security Duties

Teams that run one privacy programme for both European and Californian data often assume the GDPR is simply the stricter version of the CCPA, and that assumption produces gaps in both directions. The two laws start from different places: the GDPR requires a lawful basis before any processing, while the CCPA, as amended by the CPRA, lets a business process personal information subject to notice, purpose limits and opt-out rights. They differ on who is covered, which rights exist, how fast you must answer, what counts as a sale, and how breaches are punished. This guide sets them side by side for security, privacy and engineering leads who must build controls that satisfy both. Status checked on 13 November 2026 against EUR-Lex and the California Privacy Protection Agency text in force from 1 January 2026.

Key takeaways

Short answer: the GDPR is a permission-based law (no processing without one of six lawful bases), while the CCPA is a transparency and opt-out law with growing duties on minimisation, security audits and risk assessments.
Scope tests are different in kind. The GDPR follows establishment and targeting of people in the EU; the CCPA applies to for-profit businesses that meet a revenue or data-volume threshold and handle data of California residents.
Security duties converge. GDPR Article 32 and CCPA section 1798.100(e) both require security appropriate to the risk, and California's cybersecurity audit regulations now add a dated, certified audit cycle.
Breach exposure works differently. The GDPR has a 72-hour regulator notice and fines up to 4 % of worldwide turnover; the CCPA adds a consumer private right of action with statutory damages for breaches caused by a failure of reasonable security.
Build once, configure twice. One data inventory, one request workflow and one control set can serve both laws if you parameterise deadlines, opt-outs and notices per jurisdiction.

The two laws at a glance

The General Data Protection Regulation (Regulation (EU) 2016/679) was adopted on 27 April 2016, entered into force on 24 May 2016 and has applied since 25 May 2018. It is directly applicable in every EU member state and is enforced by national supervisory authorities. The UK keeps a parallel regime, covered in the UK GDPR and Data Protection Act 2018 Guide.

The California Consumer Privacy Act was enacted in 2018. Voters approved the California Privacy Rights Act in November 2020, which amended the CCPA, created the California Privacy Protection Agency (now branded CalPrivacy) and brought new protections into force on 1 January 2023. Updated regulations on cybersecurity audits, risk assessments and automated decision-making technology took effect on 1 January 2026. When this page says CCPA it means the act as amended by the CPRA. For the full California picture see the CCPA and CPRA guide.

Side-by-side comparison

Dimension	GDPR	CCPA as amended by the CPRA
Basic model	Processing is lawful only with one of six bases in Art. 6(1): consent, contract, legal obligation, vital interests, public task, legitimate interests	No lawful basis needed; collection and use must be disclosed and "reasonably necessary and proportionate" (1798.100(c))
Who is covered	Controllers and processors established in the EU (Art. 3(1)), and those outside it who offer goods or services to, or monitor, people in the EU (Art. 3(2))	For-profit businesses that meet one of three tests in 1798.140(d): annual gross revenue above the adjusted threshold ($26,625,000 from 1 January 2025), buying, selling or sharing data of 100,000 or more consumers or households, or 50 % or more of revenue from selling or sharing
Whose data	Any identified or identifiable natural person, whatever their nationality	A "consumer": a natural person who is a California resident, which includes employees, job applicants and business contacts
Sensitive data	Special categories under Art. 9(1) are prohibited unless an Art. 9(2) condition applies	Sensitive personal information (including account log-in plus password, precise geolocation, government IDs, biometric, genetic and neural data) carries a right to limit use (1798.121)
Response deadline for rights requests	One month, extendable by two further months where necessary (Art. 12(3))	45 days, with one 45-day extension if the consumer is told within the first 45 days (1798.130(a)(2)(A))
Third-party processing	Processor contract with the Art. 28(3) terms	Service provider or contractor contract that bars selling or sharing and limits use to the contracted purpose (1798.140)
Assessments	DPIA before high-risk processing (Art. 35)	Risk assessments for significant-risk processing and annual cybersecurity audits for in-scope businesses (2026 regulations)
Breach notice	Regulator within 72 hours where feasible (Art. 33(1)); individuals without undue delay if high risk (Art. 34(1))	Separate breach law, Civil Code 1798.82: notice to affected residents, and a sample notice to the Attorney General when more than 500 residents are notified
Penalties	Up to EUR 10m or 2 % of worldwide annual turnover (Art. 83(4)), or EUR 20m or 4 % (Art. 83(5)), whichever is higher	Administrative fines of $2,663 per violation or $7,988 for intentional violations or those involving minors under 16 (adjusted figures from 1 January 2025)
Individual lawsuits	Right to compensation for material or non-material damage (Art. 82)	Private right of action only for breaches of nonencrypted and nonredacted personal information caused by a failure of reasonable security: $107 to $799 per consumer per incident, or actual damages if greater (1798.150)
Cross-border transfers	Chapter V: adequacy decision (Art. 45) or appropriate safeguards (Art. 46)	No transfer restriction; contracts with service providers, contractors and third parties govern onward use

Scope: who has to comply

The GDPR asks where you are established and whose behaviour you target. An EU subsidiary processing customer data is in scope under Art. 3(1) wherever the servers sit. A US software company with no EU office is in scope under Art. 3(2) if it markets to EU users or tracks their behaviour, and must then appoint an EU representative under Art. 27 (see the GDPR Article 27 Representative Guide). There is no size threshold, though Art. 30(5) relieves organisations with fewer than 250 staff from keeping records of processing in most cases. Purely personal or household activity is outside the law (Art. 2(2)(c)).

The CCPA asks whether you are a for-profit business that crosses a threshold. Non-profits and government agencies are generally outside it. Several data sets are carved out in 1798.145, including protected health information under HIPAA, medical information under California's CMIA, information covered by the Gramm-Leach-Bliley Act and the California Financial Information Privacy Act, and Fair Credit Reporting Act activity. These carve-outs apply to the data, not the organisation: a bank still owes CCPA duties for website analytics data that GLBA does not cover.

Both apply: a company with EU customers and California customers above the threshold. This is the common case for SaaS, retail and media firms.
GDPR only: an EU business with no Californian customers, or a US business that targets EU users but stays under every CCPA threshold.
CCPA only: a US business that does not offer goods or services into the EU and does not monitor people there.

Rights compared

Right	GDPR article	CCPA section	Practical difference
Access or know	Art. 15	1798.110, 1798.115	CCPA responses list categories of sources, purposes and recipients as well as specific pieces of data; both expect a portable format for electronic data
Correction	Art. 16	1798.106	CCPA requires "commercially reasonable efforts" to correct
Deletion	Art. 17	1798.105	Both pass deletion downstream; CCPA lists exceptions such as security, debugging and legal compliance, GDPR ties exceptions to Art. 17(3)
Portability	Art. 20	1798.130 (format of response)	GDPR portability applies to consent or contract processing by automated means
Object or opt out	Art. 21	1798.120	CCPA opt-out covers selling and sharing for cross-context behavioural advertising; GDPR objection covers legitimate interests and all direct marketing
Restriction	Art. 18	1798.121 (limit sensitive data)	Similar intent, narrower CCPA scope
Automated decisions	Art. 22	ADMT regulations, compliance from 1 January 2027	GDPR restricts solely automated decisions with legal or similarly significant effects; California adds notice, opt-out and access duties for significant decisions
Non-discrimination	Implied by fairness principle	1798.125	CCPA allows financial incentives only with prior opt-in consent that can be revoked

Two CCPA mechanics have no direct GDPR equivalent. A business that sells or shares data must post a "Do Not Sell or Share My Personal Information" link, or honour an opt-out preference signal such as Global Privacy Control, under 1798.135, and selling or sharing data of a consumer under 16 needs affirmative authorisation (1798.120). Under the GDPR the same advertising use would usually need consent under the ePrivacy rules before any tracking starts, which is the opposite default.

Security duties side by side

For security teams the overlap is larger than the headline differences suggest. Both laws require risk-based security, contracts that flow those duties to vendors, and evidence that controls work.

Security of processing: GDPR Art. 32(1) requires measures appropriate to the risk, naming pseudonymisation and encryption, ongoing confidentiality, integrity, availability and resilience, timely restoration, and regular testing. See the GDPR Article 32 Security of Processing Guide. CCPA 1798.100(e) requires reasonable security procedures and practices appropriate to the nature of the personal information.
By design: GDPR Art. 25 requires data protection by design and by default. The CCPA reaches a similar outcome through the "reasonably necessary and proportionate" test and the duty to disclose retention periods (1798.100(a)(3)).
Audits and assessments: the GDPR requires a DPIA before high-risk processing (see the DPIA Guide). California's 2026 regulations add annual independent cybersecurity audits, with first certifications due on 1 April 2028, 2029 or 2030 depending on revenue, plus risk assessments with attestations due from 1 April 2028. The California CCPA Cybersecurity Audit and Risk Assessment Regulations Guide covers the phase-in.
Vendor contracts: GDPR Art. 28(3) lists mandatory processor terms (see the GDPR Article 28 Processor Guide); CCPA service provider and contractor contracts must bar selling and sharing and limit use to the business purpose.
Credentials as sensitive data: the CCPA definition of sensitive personal information includes an account log-in combined with a password or credentials allowing access. That pulls credential stores, password reset flows and identity provider logs into the sensitive data inventory, a point many GDPR programmes do not make explicit.

Breach notification and liability

Under the GDPR the controller notifies the lead supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals (Art. 33(1)). Processors must tell the controller without undue delay (Art. 33(2)). If the risk to individuals is high, they must be told without undue delay (Art. 34(1)).

California breach notice sits outside the CCPA in Civil Code 1798.82. A business must notify residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorised person, and must submit a sample notice electronically to the Attorney General when one breach requires notifying more than 500 residents. The statute was amended in 2025, so confirm the current notification timing against the official code text before relying on any template. The Data Breach Notification Checklist sets out both workflows.

The liability profile is where the laws differ most. GDPR exposure is mainly regulatory fines, plus civil claims under Art. 82. CCPA exposure includes the 1798.150 private right of action, which lets consumers sue for statutory damages of $107 to $799 per consumer per incident when nonencrypted and nonredacted personal information is breached because of a failure of reasonable security. At scale, statutory damages can exceed administrative fines, which is why encryption and redaction of personal information at rest carry direct legal weight in California.

When to lead with which law

Neither law replaces the other: if both apply, you must meet both. The question is which one sets the baseline of a joint programme.

Situation	Lead with	Why
Multinational with EU and US customers	GDPR baseline, CCPA overlays	Lawful basis, records of processing and DPIAs cover most CCPA disclosure and assessment needs; add opt-out links, preference signals and 45-day clocks
US-only business, adtech or data broker activity	CCPA, with other US state laws	Sale and sharing opt-outs, preference signals and minor consent drive the design
US business planning EU expansion	Design to GDPR now	Retrofitting lawful basis and consent to existing tracking is harder than starting with it
Healthcare or financial data subject to HIPAA or GLBA	Sector law plus GDPR where relevant	CCPA carve-outs remove much core data, but not website, marketing or employee data
Small company under CCPA thresholds with EU users	GDPR	No size threshold applies under the GDPR

Smaller organisations can run a single register and a single request process with jurisdiction flags. Larger ones usually need a consent and preference platform that can treat a European visitor as opt-in and a Californian visitor as opt-out, and a request system that applies the right clock and identity verification per jurisdiction (see the Data Subject Request Verification Procedure Template).

How they work together in one programme

Build one data inventory. Map systems, data categories, purposes, recipients and retention once, tagging each record with jurisdictions and whether any flow is a CCPA sale or share. The Data flow mapping for security and privacy guide shows how.
Classify sensitive data to the union of both lists. Combine Art. 9 special categories with CCPA sensitive personal information, including log-in credentials and precise geolocation.
Run one request workflow with per-jurisdiction clocks. Start the clock on receipt, apply one month for GDPR and 45 days for CCPA, and log extensions and notices.
Set the consent and opt-out layer by region. Opt-in for EU tracking, opt-out link and preference signal handling for California, tested in staging with signal on and off before release.
Use one control framework for security. Map Art. 32 and 1798.100(e) to the same control set so one audit evidences both, and plan for the California audit report from the first audit period.
Write one incident plan with two notification branches. A 72-hour regulator branch and a California resident and Attorney General branch, rehearsed in a Data Breach Tabletop Exercise.
Review annually and on law changes. California adjusts monetary thresholds every odd-numbered year and both regimes issue new guidance; recheck figures before each review.

Detection and measurement

Request timeliness: percentage of GDPR and CCPA requests closed inside the statutory clock, reported separately.
Opt-out integrity: share of sessions with an opt-out preference signal where tags that sell or share data were suppressed, from automated tag scanning.
Inventory coverage: percentage of production systems holding personal data that appear in the register with jurisdiction tags.
Encryption coverage: percentage of stores holding personal information encrypted at rest, which directly reduces 1798.150 exposure.
Breach clock performance: time from detection to decision on notifiability in exercises and real incidents, against the 72-hour target.

Log access to the request system and to exports of personal data, and alert on bulk exports by service accounts or API keys that have no documented purpose. See the Privacy Programme Metrics guide for more measures.

Framework mapping

Obligation	NIST CSF 2.0	NIST SP 800-53 Rev. 5	ISO/IEC 27001:2022 Annex A
Know which laws apply	GV.OC-03	PM-18	A.5.31
Lawful basis, purpose and notice	GV.OC-03	PT-2, PT-3, PT-5	A.5.34
Security of processing and reasonable security	PR.DS-01, PR.DS-02	SI-12 (retention)	A.5.34
DPIA and risk assessment	GV.OC-03	RA-8	A.5.34
Breach notification	RS.CO-02	IR-6, IR-8	A.5.24, A.5.26

Common failure patterns

Treating GDPR compliance as automatic CCPA compliance. GDPR programmes rarely have a "Do Not Sell or Share" link, preference signal handling or the CCPA notice categories, and these are frequent enforcement topics.
Assuming B2B or employee data is out of CCPA scope. Consumers are California residents, so staff, applicants and business contacts are covered; California's regulator has already issued a decision on job applicant notices.
Using a 30-day clock everywhere. GDPR's one month and CCPA's 45 days are not interchangeable, and the extension rules differ.
Leaving credentials out of the sensitive data map. Log-in plus password is CCPA sensitive personal information; unencrypted credential stores raise both breach risk and private right of action exposure.
One breach clock for both regimes. Teams wait for forensic certainty before deciding on GDPR notice and miss 72 hours; Art. 33 allows information to be provided in phases.
Contracts that only cover one regime. A GDPR Art. 28 data processing agreement may lack the CCPA service provider restrictions on selling and sharing.

Practitioner checklist

Record, per legal entity, whether GDPR Art. 3(1), Art. 3(2) or the CCPA thresholds apply, and review yearly.
Keep one data inventory tagged by jurisdiction, sale or share status and sensitive category under both laws.
Configure request handling with one-month and 45-day clocks and documented extension notices.
Honour opt-out preference signals for Californian users and test tag suppression before each release.
Encrypt or redact personal information at rest, prioritising credential stores and identity logs.
Use one control framework and one audit to evidence Art. 32 and 1798.100(e), aligned to the California audit cycle.
Maintain an incident plan with GDPR 72-hour and California resident and Attorney General branches.
Update vendor contracts to include both Art. 28(3) terms and CCPA service provider restrictions.

Standards and references

This guide summarises the GDPR and the CCPA as amended by the CPRA and is not legal advice. Related NHI Mgmt Group resources: GDPR Compliance Guide for Security Teams · CCPA and CPRA · Privacy Programme Guide for Security Teams · Identity Data Privacy and Consent Guide

GDPR vs CCPA/CPRA: Scope, Rights and Security Duties Side by Side