GDPR and CCPA compliance means meeting two different privacy laws at once: the EU's General Data Protection Regulation, which requires a lawful basis before you process personal data, and the California Consumer Privacy Act, which centers on notice and consumer opt-out rights. If you sell software to customers in both regions, you need one operating model that respects the stricter parts of each law, and you need to be able to prove it when an enterprise buyer sends a security questionnaire. We wrote this guide to give you that model in plain steps.
TL;DR
- The GDPR applies to any organization that processes the data of people in its scope, with no minimum company size. The CCPA applies only to for-profit businesses that do business in California and meet at least one of three thresholds.
- GDPR asks for a lawful basis (consent, contract, legitimate interest) before processing. The CCPA relies mainly on notice and opt-out.
- Response clocks differ: one month under the GDPR, generally 45 days under the CCPA, so requests should be routed by jurisdiction.
- The United States has no single national privacy law, so the CCPA is one piece of a state-by-state patchwork.
- Most enterprise buyers will ask you to evidence both through questionnaires, DPAs and a clear security posture.
Table of Contents
- What GDPR and CCPA compliance actually involve
- Who must comply with each law
- What personal data each law covers
- Lawful basis, consent and opt-outs
- Individual rights and response deadlines
- Enforcement and penalties
- Is there a GDPR equivalent in the United States?
- A practical plan for B2B software companies
- Perspective
- How Skypher helps you answer privacy questions faster
- FAQ
- Sources
What GDPR and CCPA compliance actually involve
GDPR compliance means following the data-processing rules for people within the regulation's scope: knowing what personal data you hold, why you hold it, who else touches it, and how you will honor individual rights. CCPA compliance means that, if you are a covered business, you give California consumers clear notice about what you collect and give them the ability to opt out of the sale or sharing of their personal information. The two laws differ in design, even though they share goals such as transparency and individual control.
A useful shorthand: the GDPR is permission-first, while the CCPA is notice-and-opt-out. That single difference explains most of the practical gaps you will meet in your cookie banners, your contracts and your customer-facing documentation.
Who must comply with each law
GDPR: a question of whose data you process
The GDPR is not triggered by your headquarters or your revenue. It applies to any organization processing EU residents' data, and there is no minimum size threshold. A five-person startup in Austin with European trial users is in scope in the same way a multinational is. If you want a deeper walkthrough written for American organizations, see our GDPR summary for US organizations.
CCPA: thresholds decide
The CCPA covers for-profit entities doing business in California that meet at least one of these tests, according to this comparison of the two laws:
- Annual gross revenue above $26,625,000.
- Buying, selling or sharing the personal information of 100,000 or more California consumers or households each year.
- Earning 50% or more of annual revenue from selling or sharing personal information.
The revenue line is adjusted for inflation every two years, and the $26,625,000 figure has applied since 2025. Because it moves, confirm the current number with the California Privacy Protection Agency or the California Attorney General before you rely on it for a scoping decision.
What this means for a B2B software company
Many B2B vendors assume that because their buyers are companies, privacy law is somebody else's problem. In practice you still process personal data: your customers' employees' names and work emails, usage logs, support tickets, and your own prospects' contact details. If those people are in the EU, the GDPR is relevant. If you cross a CCPA threshold and operate in California, the CCPA is relevant too. Start with an honest inventory of who is in your data, then map it to the laws.
What personal data each law covers
Both laws define personal data broadly, in terms of information that relates to an identifiable person. The GDPR protects data subjects, meaning identifiable individuals within its scope. The CCPA protects consumers, meaning California residents, and it speaks of "personal information" rather than "personal data" in its own vocabulary.
For your work, the important point is not the wording but the practical overlap. Names, email addresses, IP addresses, device identifiers and behavioral data collected through your product or website should be treated as in scope under both frameworks until your counsel tells you otherwise. Designing one data inventory that covers both is cheaper than maintaining two.
Territorial scope is where the laws split most visibly. The GDPR follows the individual in the EU's reach, wherever your servers sit. The CCPA follows the California resident and the covered business. A US company with no EU office can be subject to the GDPR; a European company with California customers can be subject to the CCPA if it crosses a threshold.
Lawful basis, consent and opt-outs
Under the GDPR, you need a specific lawful basis such as consent, performance of a contract or legitimate interest before you process personal data. You choose the basis per purpose, document it, and be ready to explain it.
Under the CCPA, you are not asked for a prior lawful basis for every processing activity. Instead you provide notice at collection and honor opt-outs from the sale or sharing of personal information. The same comparison notes that such opt-out requests must be honored as soon as feasibly possible, within 15 business days.
One operational detail deserves attention: browser-level signals. Businesses are expected to honor Global Privacy Control signals automatically and ensure the opt-out actually stops the relevant data flows, including to advertising and analytics vendors. A banner that records a choice but leaves tags firing does not meet the intent.
Side-by-side comparison
| Topic | GDPR | CCPA |
|---|---|---|
| Core model | Lawful basis required before processing | Notice and opt-out |
| Who is covered | Any organization processing in-scope data, no size minimum | For-profit businesses doing business in California that meet a threshold |
| Who is protected | Identifiable individuals within scope | California residents |
| Typical request deadline | One month, extendable to three for complexity | 45 days, extendable by 45 more |
| Opt-out of sale or sharing | Handled through consent and objection rights | Must be honored within 15 business days |
| Top-tier penalty | Up to €20 million or 4% of worldwide annual turnover, whichever is higher | Per-violation penalties, higher for intentional violations |
Individual rights and response deadlines
Both laws give people rights such as access, deletion and correction. The clocks are different. The GDPR requires a response within one month, extendable to three months for complex requests, while the CCPA generally allows 45 days, extendable by another 45 days, for requests to know, delete or correct.
The temptation is to run everything to the shorter GDPR deadline. That is a reasonable default for a small team, but it only works if requests are logged on the day they arrive and the identity of the requester is verified quickly. Whatever your policy, write down the receipt date, the jurisdiction and the due date for every request.
Enforcement and penalties
The GDPR's higher administrative fine tier can reach €20 million or 4% of a company's worldwide annual turnover, whichever is higher. If you want to see what a response looks like after the fact, our guide on what compliance officers must do after a GDPR violation covers the first steps.
California enforcement is active as well, and the CCPA allows penalties per violation, with higher amounts for intentional violations. Fines are only part of the cost. A privacy failure can stall a renewal, trigger extra diligence from customers and erode the trust that website security and customer trust depend on. For a B2B vendor, the commercial consequence of a visible gap often arrives before any regulator does.
Is there a GDPR equivalent in the United States?
No. The United States has no national comprehensive privacy law, and the CCPA is currently described as the country's most comprehensive data privacy law. Different state laws make the landscape hard to navigate. That is why many US companies build to the GDPR as a high-water mark, then add state-specific notices and opt-out handling on top.
To answer a related question readers ask: the GDPR does not itself apply because someone lives in California. It applies when its own scope rules are met, for example when you process data of people in the EU. California residents are covered by the CCPA, not the GDPR.
A practical plan for B2B software companies
1. Build one data inventory
List each category of personal data, where it comes from, where it is stored, which vendors receive it and why you process it. This single document answers the GDPR's lawful-basis question and the CCPA's notice question at once.
2. Route requests by jurisdiction
A unified intake system should route privacy requests by the requester's jurisdiction, EEA or California, so the right timeline starts automatically. Whether requests arrive by web form, email or phone, the same ticket should capture the date, the jurisdiction and the type of right being exercised. If your intake includes voice channels, handling sensitive information securely matters there too, as shown in this explanation of how patient data is handled in a regulated setting.
3. Standardize your DPA
A standard, pre-approved data processing agreement defines both parties' responsibilities and can shorten negotiation cycles with enterprise prospects. Have legal approve it once, then let sales send it without a ticket.
4. Train the go-to-market team
Sales and customer success hear privacy questions first. Training them to handle inquiries and escalate data subject requests is a recognized operational practice. A one-page escalation guide goes a long way.
5. Honor opt-out signals technically
Test that your site respects Global Privacy Control signals and that opt-outs actually stop the tags and data flows they should. Review this each time marketing adds a new vendor.
6. Keep evidence ready
Auditors and customers will ask for policies, records and responses. Our guide to what auditors want from compliance officers lists the kinds of evidence worth keeping organized, and our piece on GDPR compliance for SaaS covers the product side.
Perspective
We see the same pattern in nearly every security review. A company has genuinely done the privacy work, but the evidence sits in six places: a policy in one drive, a DPA template in another, last year's answers in a spreadsheet. When a buyer sends a 200-question security questionnaire with a dozen GDPR and CCPA items, the team rebuilds the answers by hand.
Our view is that privacy compliance becomes a sales asset only when your answers are consistent, current and fast. That is why we built Skypher around a knowledge base your team maintains once, with retrieval AI and confidence scoring designed to draft answers from your own approved content, so reviewers can focus on the questions that need a human decision.
We also believe the proof should be visible before the buyer asks. A customizable Trust Center lets you publish your security and compliance posture, so privacy questions about your GDPR and CCPA practices are answered upfront and the sales cycle moves sooner.
Gaspard
How Skypher helps you answer privacy questions faster
Privacy questions rarely arrive alone. They come inside security questionnaires and due diligence requests, often in odd formats and with tight deadlines. Our Questionnaire Automation Tool is designed to read the formats your customers send, draft answers from your approved knowledge base and show a confidence score so your team knows where to look. It integrates with third-party risk management platforms and with tools such as Slack, Microsoft Teams, Confluence, Notion, Google Drive and SharePoint, so the content you already maintain stays the source of truth.
If you would like buyers to see your posture before they ask, our Trust Center gives you a customer-facing home for it, and our smart security knowledge base keeps your answers versioned and consistent. Please feel free to see how the platform works and talk with us about your volume of questionnaires.
If you are evaluating tooling more broadly, our overview of GDPR compliance software explains what automation can and cannot take off your plate.
FAQ
What is GDPR compliance?
GDPR compliance means following the EU regulation's rules for processing personal data of people within its scope. In practice that includes having a lawful basis for each purpose, honoring individual rights within the deadlines, and keeping records you can show to customers or regulators. It has no minimum company size.
Does the CCPA apply to my company?
It applies if you are a for-profit business doing business in California and meet at least one threshold: gross annual revenue above $26,625,000, handling the personal information of 100,000 or more California consumers or households, or earning half your revenue from selling or sharing personal information. The revenue figure is adjusted periodically, so check the current number with California's privacy authorities.
Is GDPR in California?
No. California's privacy law is the CCPA. The GDPR applies when its own scope rules are met, such as processing data of people in the EU, and a California company can be subject to both laws at once.
Which deadline should we use for privacy requests?
Use the clock that matches the requester's jurisdiction: one month for GDPR requests, generally 45 days for CCPA requests to know, delete or correct, and 15 business days for CCPA opt-outs of sale or sharing. Many teams default to the shortest applicable clock to keep the process simple.
Sources
- GDPR vs CCPA: Key Differences Every Business Should Know
- GDPR vs CCPA: Who You Serve Decides Which Rules Apply
- What Is the CCPA? The California Consumer Privacy Act
- CCPA vs GDPR in 2026: What Your Cookie Banner Must Do
- DSR Fulfillment Deadlines: Response time for the various data privacy laws
- GDPR and CCPA/CPRA Compliance for B2B SaaS
- U.S. Data Privacy Laws: A Guide to the 2026 Landscape