Regulations › European Union
GDPR
General Data Protection Regulation (EU) 2016/679
WhenIn effect since 25 May 2018
Who enforces itNational data protection authorities, coordinated by the European Data Protection Board
Who it applies toOrganizations established in the EU, and organizations outside it that offer goods or services to people in the EU or monitor their behavior.
Tell the regulatorNotify the supervisory authority without undue delay and, where feasible, within 72 hours of b…
DPO requiredDPO required for public bodies, large-scale systematic monitoring, or large-scale special-cate…
RegistrationNo general registration
Transfers abroadTransfers outside the EEA need an adequacy decision or appropriate safeguards (SCCs, BCRs), or…
Request deadlineRespond within one month, extendable by two further months for complex or numerous requests
Maximum fineUp to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher
48%
of European Union's 21 requirements are already met by California (CCPA). Here is what GDPR adds, biggest gaps first.
Transfers abroadTransfersBig gap
CCPA– Not addressed
GDPR adds2 Transfers outside the EEA need an adequacy decision or appropriate safeguards (SCCs, BCRs), or a listed derogation.
Arts. 44-49 · source ↗
Lawful basisReach and lawful basisGap
CCPA0 No lawful-basis requirement; notice at collection plus purpose limitation, with opt-out of sale/sharing.
GDPR adds1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
Art. 6(1) · source ↗
ConsentReach and lawful basisGap
CCPA1 Opt-out model; opt-in consent required to sell/share data of consumers under 16 and to re-opt-in after an opt-out.
GDPR adds2 Consent must be freely given, specific, informed and unambiguous by clear affirmative action, and the controller must be able to demonstrate it.
Art. 4(11), Art. 7(1) · source ↗
Sensitive dataReach and lawful basisGap
CCPA1 Sensitive personal information defined; consumers may limit its use to listed necessary purposes, with notice required.
GDPR adds2 Special categories (health, biometrics, religion, etc.) are prohibited unless explicit consent or another listed exception applies.
Art. 9(1)-(2) · source ↗
Request deadlinePeople's rightsGap
CCPA1 45 days to respond to know, delete and correct requests, extendable once by 45 days; opt-out requests within 15 business days.
GDPR adds2 Respond within one month, extendable by two further months for complex or numerous requests.
Art. 12(3) · source ↗
MarketingPeople's rightsGap
CCPA1 Right to opt out of selling or sharing data for cross-context behavioral advertising; email marketing governed by federal CAN-SPAM.
GDPR adds2 Absolute right to object to direct marketing; prior consent required for electronic marketing under the ePrivacy Directive, with a customer soft opt-in.
Art. 21(2)-(3); ePrivacy Directive 2002/58/EC Art. 13 · source ↗
DPO requiredGovernanceGap
CCPA0 No DPO requirement; executive accountable for risk-assessment attestations and cybersecurity audit certification.
GDPR adds1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
Art. 37(1) · source ↗
DPO qualificationsGovernanceGap
CCPA– Not addressed
GDPR adds1 DPO chosen for professional qualities, especially expert knowledge of data protection law and practice; no certification required.
Art. 37(5) · source ↗
RecordsGovernanceGap
CCPA1 No general record of processing; businesses keep records of consumer requests for at least 24 months.
GDPR adds2 Controllers and processors keep records of processing; limited exemption for organizations under 250 employees doing occasional, low-risk processing.
Art. 30(1), (5) · source ↗
Maximum fineEnforcementGap
CCPA2 Up to USD 2,663 per violation or USD 7,988 per intentional violation or violation involving minors, with no aggregate cap.
GDPR adds3 Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher.
Art. 83(5) · source ↗
Criminal liabilityEnforcementGap
CCPA– Not addressed
GDPR adds1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
Art. 84 · source ↗
Already covered by CCPA: Reach abroad, Children, Rights, Registration, DPIA, Retention, Tell the regulator, Tell people, Localization, Private action.
A gap means GDPR is more demanding than CCPA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws