GDPR vs CCPA/CPRA: Side-by-Side Comparison (with LGPD)

GDPR vs CCPA/CPRA vs LGPD

Published September 2026 · Compliance · GDPR. Cross-link: GDPR compliance hub · CCPA hub · CSA for GDPR.

Topic	GDPR	CCPA/CPRA	LGPD
Scope trigger	Art 3 offering/monitoring; no size threshold	CA consumers + revenue/volume thresholds	Processing related to Brazil / Brazilian individuals
Permission model	Positive Art 6 lawful basis	Primarily opt-out of sale/share (+ notice)	Legal bases including consent and legitimate interest themes
Core rights	Chapter III (Arts 12–22), 1-month clock (Art 12(3))	Know, delete, correct, opt-out, limit sensitive use (CPRA)	Access, correction, deletion, portability, information
Breach	Art 33 ~72h to SA; Art 34 if high risk	CA Civil Code breach notice (separate from CCPA privacy rights)	ANPD notification rules as applicable
Max fines (illustrative)	Art 83: up to €20M or 4% worldwide turnover (higher tier)	Civil penalties per violation (e.g. intentional higher tier)	Administrative fines under LGPD (percentage of Brazilian revenue caps)
Transfers	Chapter V adequacy / SCCs / etc.	No GDPR-style adequacy regime	International transfer mechanisms under LGPD

Operational takeaway

Do not treat CCPA opt-out language as a GDPR lawful basis. For EU personal data you still need Article 6 documentation, Article 30 RoPA, Article 28 processor contracts, and Article 32 security measures. Use one evidence plane for shared TOMs, then branch notices and rights workflows by law.

Frequently Asked Questions

What is the biggest difference between GDPR and CCPA?

GDPR requires a positive lawful basis under Article 6 for each processing activity and applies with no revenue threshold when Article 3 is met. CCPA/CPRA is primarily an opt-out regime for California consumers and applies to businesses meeting revenue or data-volume thresholds.

Do I need both GDPR and CCPA?

Often yes if you serve EU/EEA individuals and California consumers. Map shared security and rights workflows once, then track jurisdiction-specific notices, opt-outs, and transfer rules separately.

Where does LGPD fit?

Brazil’s LGPD is a third major regime for organisations processing Brazilian personal data. Keep it on the same comparison matrix so global programmes do not treat CCPA as a GDPR substitute.

GDPR hub · US extraterritorial scope · vs Saudi PDPL · CSA