GDPR vs CCPA/CPRA: scope and the work you can share
Start by establishing which law applies to which processing activity. GDPR and the CCPA as amended by the CPRA share concerns about transparency, individual rights and security, but they use different scope rules and legal tests. One privacy notice or request workflow may support both only after those differences are addressed.
Updated
Side-by-Side Comparison
| Evaluation Criterion | GDPR | CCPA/CPRA |
|---|---|---|
| Territorial scope | EU establishment and specified targeting or monitoring outside the EU | Covered businesses doing business in California |
| Processing rules | An appropriate lawful basis; additional conditions for special-category data | Notice, purpose and use limits, contracts and applicable consumer choices |
| Consumer choices | Access, correction, erasure and other qualified rights | Know, delete, correct, opt out of sale/sharing and other qualified rights |
| Small organisations | No general revenue exemption | Business thresholds and specific exemptions need assessment |
Assess scope first
GDPR scope depends on establishment or the relevant offering of goods or services to, or monitoring of, people in the EU. Citizenship alone is not the test. CCPA applicability involves doing business in California and the statutory business definition, thresholds and exemptions. Check the CPPA's current guidance and inflation-adjusted monetary thresholds.
Consent is not the whole GDPR model
GDPR provides several lawful bases. Consent is one, and explicit consent is relevant in particular circumstances; it is not the default basis for all processing. CCPA also imposes duties beyond offering an opt-out link. Assess the actual purpose, data and disclosure before designing the workflow.
Map recipients and contracts
A shared data inventory can help both reviews. Record why each recipient receives information, what they can do with it and the contractual restrictions. Then assess GDPR controller and processor roles and the CCPA service-provider, contractor and third-party rules separately.
Build rights workflows with distinct decision rules
A common intake process can route requests, verify identity where needed and find the relevant records. Keep the legal deadlines, exceptions and response requirements for each law explicit. Do not reject a request solely because a similar right under the other law would not apply.
Review tracking and advertising
Inspect the data flows from analytics, advertising and embedded services. Assess applicable consent requirements and California sale/sharing opt-outs, including recognised preference signals. A banner or a link is only useful if the underlying processing respects the choice.
Making the decision
Share the inventory and operational workflow where useful. Keep scope, lawful processing, disclosures and rights decisions specific to each law. Compliance with one does not establish compliance with the other.