Regulation (EU) 2016/679. Applies in the EU and, under Article 3(2), to organisations outside it that target or monitor people in the EU.
Cal. Civ. Code §1798.100 et seq., as amended by the CPRA. Applies to for-profit businesses that meet a revenue or data-volume threshold.
Twelve areas where the two laws differ
Article 3: controllers and processors established in the EU, and those outside the EU that offer goods or services to, or monitor the behaviour of, people in the EU. No revenue or volume threshold.
§1798.140(d): for-profit businesses doing business in California that meet at least one threshold: annual gross revenue above the inflation-adjusted figure (originally $25M), buying, selling or sharing personal information of 100,000+ consumers or households, or 50%+ of revenue from selling or sharing personal information.
Any identified or identifiable natural person whose data falls within scope (Article 4(1)). Residency and citizenship are not the test.
California residents ("consumers"), including employees and business contacts since 1 January 2023.
Article 6 requires one of six lawful bases before processing: consent, contract, legal obligation, vital interests, public task or legitimate interests. Article 9 adds conditions for special categories.
No lawful-basis requirement. Processing must be disclosed in a notice at collection and be reasonably necessary and proportionate to the disclosed purpose (§1798.100(c)).
Articles 15 to 22: access, rectification, erasure, restriction, portability, objection, and rights relating to automated decision-making. Consent can be withdrawn at any time (Article 7(3)).
As amended by the CPRA: right to know and access, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and non-retaliation.
No standalone "sale" concept. Any disclosure needs a lawful basis and must fit the stated purpose; the right to object applies to direct marketing (Article 21(2)).
A "Do Not Sell or Share My Personal Information" link is required where data is sold or shared for cross-context behavioural advertising. Opt-in is required to sell or share data of consumers under 16.
Article 8: parental consent for information society services offered directly to a child under 16, which member states may lower to no less than 13.
Opt-in consent to sell or share personal information of consumers aged 13 to 15; parental consent under 13 (§1798.120(c)).
Article 37(1): mandatory for public authorities, and where core activities involve large-scale regular and systematic monitoring or large-scale processing of special-category or criminal data.
No DPO requirement.
Article 30 records of processing. The Article 30(5) exemption for organisations under 250 employees does not apply where processing is likely to result in a risk, is not occasional, or covers special categories. DPIAs under Article 35 for high-risk processing.
Records of consumer requests and responses kept for at least 24 months (CCPA Regulations §7101). CPPA regulations add risk-assessment and cybersecurity-audit duties for certain businesses.
Article 33: notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware. Article 34: notify individuals without undue delay where the breach is likely to result in a high risk.
Handled by California's breach statute, Civil Code §1798.82: notify affected residents in the most expedient time possible and without unreasonable delay; copy the Attorney General if more than 500 residents are notified.
One month from receipt, extendable by two further months where necessary, with the person told of the extension within the first month (Article 12(3)).
45 calendar days, extendable once by a further 45 days with notice (§1798.130(a)(2)).
Supervisory authorities. Article 83(5): up to €20 million or 4% of total worldwide annual turnover, whichever is higher.
California Privacy Protection Agency and Attorney General. Up to $2,500 per violation, or $7,500 per intentional violation or violation involving minors (§1798.155, §1798.199.90), adjusted for inflation.
Individuals may bring court proceedings (Article 79) and claim compensation for material or non-material damage (Article 82).
Private right of action limited to certain data breaches caused by a failure to maintain reasonable security: $100 to $750 per consumer per incident, or actual damages if greater (§1798.150).
Decision framework for your business
Worth knowing: GDPR groundwork (data inventory, request handling, vendor contracts) carries over, but CCPA adds its own items: the notice at collection, the "Do Not Sell or Share" link, opt-out preference signals and the 45-day window. Whether either law applies is a determination your organisation makes and records; consult legal counsel where it is unclear.
In ReadyGDPR, both GDPR (36 controls) and CCPA/CPRA (22 controls) are adoptable, each with its own control catalogue quoted from its own instrument.
On most points GDPR asks for more before processing starts: a lawful basis for every purpose, records of processing, and a 72-hour breach clock. CCPA goes further in a few places, such as the explicit opt-out link for selling or sharing data and the private right of action for security breaches. Which obligations bite depends on what your organisation does with data.
No. Much of the groundwork overlaps (data inventory, access and deletion processes, vendor contracts), but CCPA has its own requirements that GDPR does not cover: the notice at collection format, the "Do Not Sell or Share" link, honouring opt-out preference signals, the right to limit sensitive personal information, and the 45-day response window.
Yes. A company outside the EU that offers services to people in the EU can fall under GDPR Article 3(2), and the same company can meet a CCPA threshold through its California customers. The two tests are independent and each needs its own determination.
Only if one of the three thresholds is met. A small business that sells or shares the personal information of 100,000 or more California consumers or households can be covered regardless of revenue.
ReadyGDPR is software, not an appointed Data Protection Officer. If Article 37 requires you to appoint one, ReadyGDPR helps them do the job — it doesn’t replace them.