Data privacy laws explained: GDPR, UK GDPR, CCPA and CPRA

GDPR, UK GDPR, CCPA and CPRA are data privacy laws that control how organizations collect, use and protect personal data. Each one applies in a different place and gives people different rights. This guide defines each law in plain English first, then covers what it means in practice.

What is GDPR?

The General Data Protection Regulation (GDPR) is the European Union's data protection law. It sets rules for how organizations collect, use, store and share personal data about people in the EU, and it gives those people rights over their data. It took effect on May 25, 2018.

Personal data means any information that can identify a person, directly or indirectly. Examples include names, email addresses, location data, online identifiers and photos.

Who GDPR applies to

• Organizations established in the EU that process personal data
• Organizations outside the EU that offer goods or services to people in the EU
• Organizations outside the EU that monitor the behavior of people in the EU

The seven principles of GDPR

Principle	What it means
Lawfulness, fairness and transparency	Have a valid legal basis and be open about what you do with data
Purpose limitation	Collect data for specified purposes and do not use it in incompatible ways
Data minimization	Collect only what you need
Accuracy	Keep data accurate and up to date
Storage limitation	Keep data only as long as needed
Integrity and confidentiality	Protect data with appropriate security
Accountability	Be able to show that you comply

Individual rights under GDPR

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure, often called the right to be forgotten
• The right to restrict processing
• The right to data portability
• The right to object
• Rights related to automated decision-making and profiling

What GDPR requires of organizations

• Identify a lawful basis for each type of processing, such as consent, contract or legitimate interests
• Publish clear privacy notices
• Keep records of processing activities
• Carry out data protection impact assessments for high-risk processing
• Appoint a data protection officer where required
• Put contracts in place with processors that handle data on your behalf
• Report certain personal data breaches to the regulator within 72 hours of becoming aware of them
• Respond to individual rights requests, usually within one month

Fines can reach 20 million euros or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches.

What is UK GDPR?

The UK GDPR is the version of the GDPR that applies in the United Kingdom. It forms part of UK law after Brexit through the Data Protection Act 2018 and the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019. The Information Commissioner's Office (ICO) is the UK regulator.

The UK GDPR is very similar to the EU GDPR. The main principles, rights and obligations are the same, with changes to reflect the UK context, such as references to UK institutions and rules on international transfers.

EU GDPR vs UK GDPR

Item	EU GDPR	UK GDPR
Applies to	Processing connected to the EU	Processing connected to the UK
Regulator	National data protection authorities in each member state	Information Commissioner's Office
Supporting law	National laws in each member state	Data Protection Act 2018
International transfers	Rules set by the EU and adequacy decisions by the European Commission	Rules set by the UK, with UK adequacy regulations and UK transfer tools
Maximum fine	20 million euros or 4% of worldwide turnover	17.5 million pounds or 4% of worldwide turnover

Organizations that work in both the UK and the EU often need to comply with both regimes. The UK government has also introduced reforms to UK data protection law over time, so check current guidance from the ICO for the latest position.

What is CCPA?

The California Consumer Privacy Act (CCPA) is a California state law that gives California residents rights over the personal information that businesses collect about them. It took effect on January 1, 2020. It focuses on transparency and on giving people control over the sale and sharing of their data.

Which businesses must comply with CCPA

The CCPA applies to for-profit businesses that do business in California and meet at least one threshold. Thresholds are updated over time, so check the current figures.

• Annual gross revenue above a set dollar threshold
• Buying, selling or sharing the personal information of a large number of consumers or households
• Earning a large share of annual revenue from selling or sharing personal information

Consumer rights under CCPA

• The right to know what personal information is collected, used, shared or sold
• The right to delete personal information, with some exceptions
• The right to opt out of the sale or sharing of personal information
• The right to non-discrimination for exercising privacy rights

What CCPA requires of businesses

• Give notice at or before the point of collection
• Publish a privacy policy and update it each year
• Provide ways for consumers to submit requests, such as a web form and a toll-free number in some cases
• Respond to requests within set time limits, generally 45 days
• Include a clear Do Not Sell or Share My Personal Information link where relevant
• Have contracts with service providers that limit how they use data

Unlike the GDPR, the CCPA does not require a lawful basis for processing. It works more through notice, choice and opt-out rights.

What is CPRA?

The California Privacy Rights Act (CPRA) is a California law that amended and expanded the CCPA. Voters approved it in 2020, and its main provisions took effect on January 1, 2023. Businesses often refer to the combined law as CCPA as amended by CPRA.

What CPRA changed

Area	What CPRA added or changed
Sensitive personal information	A new category that includes data such as precise location, health data, government identifiers and racial or ethnic origin, with a right to limit its use
New consumer rights	Rights to correct inaccurate information and to opt out of sharing for cross-context behavioral advertising
Data minimization and retention	Businesses must limit collection, use and retention to what is reasonably necessary and disclose retention periods
Enforcement	Created the California Privacy Protection Agency to enforce the law alongside the Attorney General
Service providers and contractors	More detailed contract requirements and obligations

CCPA vs CPRA

CPRA is not a separate law that replaces CCPA. It changes the CCPA, so organizations comply with both together. If you already follow the CCPA, the CPRA means extra work on sensitive data, correction rights, retention and vendor contracts.

Comparing GDPR, UK GDPR, CCPA and CPRA

Item	GDPR	UK GDPR	CCPA and CPRA
Where it applies	EU	United Kingdom	California
Protects	People in the EU	People in the UK	California residents
Legal basis required	Yes	Yes	No, but notice and opt-out rules apply
Main model	Rights and lawful basis for processing	Same as GDPR with UK law	Notice, access, deletion and opt-out rights
Regulator	National authorities	ICO	California Privacy Protection Agency and Attorney General
Breach notice	Regulator within 72 hours where required	ICO within 72 hours where required	Rules set by state breach laws, with private right of action for certain breaches

The laws overlap on many points: transparency, access rights, deletion and security. A single privacy program built on clear data maps, notices, request handling and vendor controls can cover most of them, with local additions.

How to manage data privacy compliance in practice

1. Map the data

Record what personal data you hold, where it comes from, where it goes and who has access. Without this you cannot answer rights requests or assess risk.

2. Work out which laws apply

List the countries and states where you have customers, staff and operations. Match them to the laws that apply. Other regions, such as other US states and countries around the world, have their own privacy laws.

3. Update notices and policies

Write privacy notices in plain language. Keep internal policies on data handling, retention and breach response current and make sure people have read them.

4. Set up a process for individual requests

Have a clear route for access, deletion, correction and opt-out requests. Log each request and track deadlines.

5. Control vendors

Review the suppliers that handle personal data. Put the right contract terms in place and check that they meet your standards.

6. Train staff and prepare for breaches

Train people to spot and report incidents. Test the breach response plan, including how to notify regulators and affected individuals.

7. Track change and keep evidence

Privacy laws change often. Someone needs to watch for new laws, amendments and regulator guidance and update policies and processes in response. Keep records that show what you did and when. Ideagen's regulatory compliance solution helps teams track regulatory change and link updates to the policies and processes they affect, which supports the monitoring and evidence side of privacy compliance. Legal and privacy teams still decide what each law means for the business.

Frequently asked questions

What is GDPR in simple terms?

It is the EU law that controls how organizations handle personal data and gives people rights over their data.

What is the difference between GDPR and UK GDPR?

They are very similar. GDPR applies in the EU. UK GDPR applies in the UK, sits alongside the Data Protection Act 2018 and is overseen by the ICO.

What is the difference between CCPA and CPRA?

CCPA is the original California privacy law. CPRA amended and expanded it, adding sensitive personal information, correction rights and a dedicated enforcement agency.

Does GDPR apply to US companies?

It can. A US company must follow GDPR if it offers goods or services to people in the EU or monitors their behavior.

Does CCPA apply outside California?

It protects California residents, so businesses anywhere that meet the thresholds and handle California residents' data may need to comply.