Same goal, different models
Both laws protect personal information, but they take different approaches. GDPR (EU/UK) is a consent- and lawful-basis model; CCPA/CPRA (California) is primarily an opt-out model.
GDPR in brief
The EU/UK General Data Protection Regulation protects the personal data of people in the EU/UK and applies to any organization processing that data — wherever the organization is based.
You need a lawful basis to process data, must honor strong individual rights (access, erasure, portability, and more), and can face fines up to €20 million or 4% of global annual turnover.
CCPA/CPRA in brief
California's privacy law protects California residents' personal information and applies to for-profit businesses that meet certain thresholds — for example, over $25 million in annual revenue, or handling the personal information of 100,000+ consumers or households.
It gives consumers rights to know, delete, correct, and opt out of the sale or sharing of their personal information, and is enforced by the California Privacy Protection Agency.
Where they differ most
The biggest differences are the legal basis (GDPR requires one up front; CCPA is opt-out), the definition of a sale of data, breach-notification rules, and requirements such as appointing a Data Protection Officer.
CPRA vs GDPR: what changed in California
The California Privacy Rights Act (CPRA) amended the CCPA from 2023. It moved California closer to GDPR: it created the California Privacy Protection Agency as a dedicated regulator, added a category of 'sensitive personal information' with a right to limit its use, and introduced rights to correct data and to opt out of cross-context behavioural advertising ('sharing').
Differences remain. GDPR requires a lawful basis before any processing; CPRA is still largely an opt-out model. GDPR applies to almost any organisation processing EU residents' data; CPRA applies only to businesses meeting its revenue or data-volume thresholds.
- Regulator: GDPR — national data protection authorities; CPRA — California Privacy Protection Agency
- Consent model: GDPR — lawful basis up front; CPRA — notice plus opt-out (opt-in for minors)
- Sensitive data: both define it; CPRA adds a 'limit use' right
- Data minimisation and retention limits: now explicit in both
What you need for both
A data map, a clear privacy notice that covers both laws, mechanisms to handle rights requests and opt-outs, and data-processing agreements with your vendors.
How muVerity helps
We map your data, assess gaps against both laws, draft policies and notices, and build rights-request workflows.