How Does The CCPA Compare To The GDPR?

On May 25, 2018, the General Data Protection Regulation (GDPR) came into effect - marking one of the most critical digital developments of the century. The legislation originated in the European Union (EU), and effectively protects the data rights of European Economic Area (EEA) residents. However, companies around the world that target users in the EEA are subject to comply with the hefty legislation.

While the effects of the GDPR itself have been felt these past two years, one of the most notable changes it has brought to the digital space is an influx in copycat legislation, and a call for similar protections to users’ data around the globe. 

Among the laws, regulations, and guidelines that have followed in the footsteps of the GDPR is the California Consumer Privacy Act (CCPA). As its name implies, this law comes from California, and serves to protect Golden State residents whose data is collected and shared by companies all over the world. 

How Are the CCPA and GDPR Similar? 

The CCPA is based on the GDPR, although it is notably lighter in size and scope. Both laws seek to protect the rights of individuals over their personal information by establishing data-handling best practices for businesses, and new data rights for users.

Among the shared features of the laws is the emphasis on accountability.  Both pieces of legislation threaten hefty fines for companies who fail to protect the data they collect from individuals and establish minimum expectations of data security. 

For example, both the GDPR and the CCPA emphasize the need for companies to implement Privacy by Design (PbD). PbD is the idea that privacy measures and data protection is built into the very framework of a business, website, or app. 

Given the potential consequences for failing to take data privacy seriously - millions of dollars in fines - both laws are setting new standards for data safety. 

How Are the Laws Different? 

While the CCPA is sometimes referred to as the California GDPR, these laws are far from the same. The GDPR is notably stricter, broader in scope, and ladened with far fewer loopholes than the CCPA. 

For example, the CCPA sets thresholds to determine what companies are subject to comply. These thresholds include annual revenue, revenue generated by data sale, and how many consumers’ data is collected. 

The GDPR, on the other hand, is applicable to any business that targets users in the EEA — regardless of company size, location, or revenue. In effect, a small travel blog in Idaho that sends newsletters to a few people in Switzerland is subject to comply with the GDPR. They would not, on the other hand, likely need to comply with the CCPA. 

Another key distinction between the two laws is the extent of their guidelines. The GDPR lays out extensive guidelines and boundaries for proper data handling, while the CCPA sets remarkably fewer strictures. 

Of the most significant requirements the GDPR establishes is the right for users to opt in to data collection. This guideline revolves around the notion that if businesses aren’t collecting data on a legal basis such as legitimate interests or to fulfill a contract, they should be basing that data collection on user consent. Therefore, businesses need to ask for users to opt in to the collection of their data. 

Alternatively, the CCPA has no such guidelines, and only sets a requirement for businesses to allow users to opt out of the sale of their personal information. 

What Does It All Mean for Businesses? 

Not only are thousands of businesses around the world subject to comply with one or both of these landmark privacy laws, but the GDPR and CCPA are only the beginning of a new wave of digital legislation. 

With over a hundred countries implementing or working to implement similar laws, the CCPA and GDPR are the foundation of the new standards for data privacy and protection. 

If you own or operate a website, app, or business that relies on consumer data, you need to understand these laws and the goals they seek to achieve.

To learn more about the key similarities and differences between the GDPR and CCPA, check out this infographic from Termly below:

You Might Also Read: 

GDPR's Impact In The US And Globally:

 

 

« Take Action On Cyber Security Training
AI Can Give An Early Warning Of Coronavirus »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Wireless Logic

Wireless Logic

Wireless Logic delivers a range of secure and resilient value-added M2M/IoT managed services that empower remote devices to communicate cost-effectively, two ways.

VigiTrust

VigiTrust

VigiTrust is a security firm specializing in cloud based eLearning programs, security compliance portals and providing security assessments.

Auxilium Cyber Security

Auxilium Cyber Security

Auxilium Cyber Security is independent information security consultancy company providing cyber security services tailored to meet the evolving needs of organizations worldwide.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

LSoft Technologies

LSoft Technologies

LSoft Technologies is a leader in data recovery software technologies.

BeyondTrust

BeyondTrust

BeyondTrust is a leader in Privileged Access Management, offering a seamless approach to preventing data breaches related to stolen credentials, misused privileges, and compromised remote access.

1Password

1Password

1Password combines industry-leading security with award-winning design to bring private, secure, and user-friendly password management to everyone.

Valency Networks

Valency Networks

Valency Networks provide cutting edge results in the areas of Vulnerability Assessment and Penetration Testing services for webapps, cloud apps, mobile apps and IT networks.

Silent Quadrant

Silent Quadrant

Silent Quadrant delivers incomparable cybersecurity consulting, digital transformation, and risk management within our purpose-driven clients - empowering them to be the most resilient entities.

Detego Global

Detego Global

Detego Global are the creators of the Detego® Unified Digital Forensics Platform, a suite of modular tools used globally by military, law enforcement and intelligence agencies, and enterprises.

Bitdefender

Bitdefender

Bitdefender is a cybersecurity leader delivering best-in-class threat prevention, detection, and response solutions worldwide.

CampusGuard

CampusGuard

CampusGuard focuses on the cybersecurity and compliance needs of campus-based organizations including higher education, healthcare, and state and local government.

Zluri

Zluri

Zluri is a cloud-native SaaSOps platform enabling modern enterprises with SaaS Management and Identity Governance.

Aliro Security

Aliro Security

AliroNet is the world’s first entanglement Advanced Secure Network solution.

CarbonHelix

CarbonHelix

CarbonHelix provides cybersecurity services from US-based security operations centers that meet the highest compliance requirements.

Infrassist Technologies

Infrassist Technologies

We're Infrassist - a trusted white label Managed IT & Professional Services partner for MSP businesses.