Beyond SOC 2
What is the main difference between GDPR and CCPA?
What is the main difference between GDPR and CCPA?
The main difference is the default. GDPR requires a lawful basis, such as consent or contract, before personal data is processed at all, and it applies to any organization handling data of people in the EU regardless of size. CCPA lets businesses collect personal information by default and gives California consumers rights to know, delete, correct, and opt out of its sale or sharing, and it applies only to for-profit businesses above set thresholds. GDPR is also far more expensive to breach, with fines up to 4% of global annual turnover.
GDPR and CCPA side by side
Which one applies to a US SaaS company
Below the CCPA revenue threshold, a startup can still be caught by the 100,000 consumers test if it handles a large consumer user base, and it is often caught contractually anyway, because enterprise customers push their own GDPR and CCPA obligations onto vendors through data processing agreements.
Where they overlap in practice
The operational work is largely shared. Both laws expect you to know what personal data you hold and where it flows, to honor access and deletion requests within set deadlines, to secure the data with reasonable measures, and to bind your vendors by contract. A data inventory, a subprocessor list, a documented request-handling procedure, and a security program covering access control and encryption satisfy most of both at once.
Neither law is a security framework, and a SOC 2 report does not discharge either. SOC 2 does produce much of the security evidence both laws ask for. For how SOC 2 relates to the legal regimes around it, see is SOC 2 legally required.