GDPR requires a lawful basis before you process personal data and applies by territory and targeting. The CCPA applies to covered businesses that meet thresholds and centres on notice, access, deletion and opt out of sale or sharing. A single program can serve both if you build to the stricter requirement for each task.
Side by side
- Who is covered. GDPR: controllers and processors, by establishment or by offering to or monitoring people in the EU. CCPA: for-profit businesses doing business in California that meet a threshold.
- Starting rule. GDPR: you need a lawful basis, one of six listed. CCPA: notice at collection, consumer rights and an opt out model.
- Response time. GDPR: one month, extendable by two months. CCPA: 45 calendar days, extendable by 45.
- Opt out. GDPR: right to object and to withdraw consent. CCPA: opt out of sale or sharing, with Global Privacy Control honored.
- Regulator notice of a breach. GDPR: 72 hours where feasible. CCPA: check the statute, this post did not review it.
- Maximum fines. GDPR: 10 or 20 million euros, or 2 or 4 percent of turnover. CCPA: check the statute, this post did not review it.
The statements above come from the GDPR articles and the California Attorney General's page cited below.
Where the models differ most
Permission versus notice. GDPR asks "what is your basis?" for every purpose. The CCPA starts from notice and lets consumers say no to sale or sharing. For sales of children's data it requires opt in consent, according to the Attorney General.
Sensitive data. GDPR has special categories with extra conditions. The CCPA gives consumers a right to limit use and disclosure of sensitive personal information.
Deadlines. The one month and 45 day clocks are close enough that one internal target works. Aim for 30 days and you meet both.
Building one program
- One data inventory, tagged by region and purpose.
- One request intake that routes access, deletion, correction and opt out.
- One privacy notice structure with regional sections.
- Honor opt out signals for California visitors and consent choices for EU visitors in the same consent layer.
- Processor contracts that cover both.
- A breach process that works to the shortest regulator clock you face.
Where one program is not enough
Some duties have no twin. GDPR needs a lawful basis, impact assessments for high risk processing and rules for international transfers. California rules add specific link and signal requirements and new audit and risk assessment duties on a phased timeline, see the new California rules.
Quick check
If we comply with GDPR, are we compliant with CCPA?
No. Many controls overlap, but the CCPA has its own notices, links and signals.
Which has the higher fines?
GDPR sets published maximums in Article 83. This post did not review the CCPA penalty provisions, so check the statute.
Sources
- California Attorney General, California Consumer Privacy Act
- GDPR Article 12, one month response
- GDPR Article 6, lawful bases
- GDPR Article 33, breach notification
- GDPR Article 83, fines
- GDPR Article 3, territorial scope
Last reviewed: 19 October 2026.
