What GDPR is, in one paragraph
The General Data Protection Regulation is the European Union's omnibus privacy law, in force since 2018. It applies to any organization processing personal data of people in the EU, regardless of where the organization is based. Its central premise: personal data belongs to the individual, and processing it requires lawful basis (usually consent).
What CCPA/CPRA is, in one paragraph
The California Consumer Privacy Act (and its 2023 update, the California Privacy Rights Act) governs how businesses doing significant business in California handle the personal information of California residents. CPRA strengthened CCPA significantly, adding rights similar to GDPR but with a fundamentally opt-out (rather than opt-in) default.
Default consent model
GDPR is opt-in: consent must be freely given, specific, informed, and unambiguous, pre-ticked boxes don't count. CCPA is opt-out: a business may collect and use personal information unless the consumer specifically opts out (with some exceptions for sensitive categories under CPRA).
Who is covered
GDPR covers any organization processing personal data of EU residents, regardless of organization size. CCPA covers for-profit businesses meeting thresholds: $25M+ in revenue, or processing data of 100,000+ California consumers, or deriving 50%+ of revenue from selling personal information.
Free Compliance Health Check
Get a confidential 30-min review of your privacy and compliance posture, no obligation.
Consumer rights
Both grant rights to access, delete, and correct personal data. GDPR additionally provides the right to data portability, the right to object to processing, and rights related to automated decision-making. CPRA closed much of this gap with rights to correct, limit use of sensitive data, and opt out of automated decisioning.
Penalties
GDPR fines reach the greater of €20 million or 4% of global annual revenue. CCPA/CPRA fines are smaller per violation ($2,500-$7,500) but accumulate. Practical impact: GDPR penalties are existential for big violations; CCPA penalties are operational drag for sustained non-compliance.
Data Protection Officer (DPO)
GDPR requires a DPO for organizations whose core activities involve large-scale or systematic processing. CPRA doesn't formally require a DPO but expects similar privacy governance through a 'privacy professional' or equivalent role.
Cross-border data transfers
GDPR restricts transfer of EU personal data to countries without adequate protection. The EU has designated Canada (commercial sector) as adequate, which simplifies Canadian compliance. CCPA doesn't place geographic restrictions on transfers.
What this means for a Canadian business
If you sell only in Canada and the US, you usually need to comply with CCPA (if you meet thresholds), CASL/PIPEDA (always), and consider GDPR-style practices as a moat. If you sell into Europe, you need full GDPR compliance. The practical baseline for everyone: explicit consent, documented purposes, and clear data subject rights handling.
Privacy law is converging globally toward an opt-in, rights-respecting baseline. Canadian businesses that adopt GDPR-style practices today not only satisfy the strictest applicable regime, they earn the trust premium that drives modern marketing.
Frequently asked questions
Quick answers to common questions on this topic. Have a specific situation? Talk to our team.
What GDPR is, in one paragraph?
The General Data Protection Regulation is the European Union's omnibus privacy law, in force since 2018. It applies to any organization processing personal data of people in the EU, regardless of where the organization is based. Its central premise: personal data belongs to the individual, and...
What CCPA/CPRA is, in one paragraph?
The California Consumer Privacy Act (and its 2023 update, the California Privacy Rights Act) governs how businesses doing significant business in California handle the personal information of California residents. CPRA strengthened CCPA significantly, adding rights similar to GDPR but with a...
What is default consent model?
GDPR is opt-in: consent must be freely given, specific, informed, and unambiguous, pre-ticked boxes don't count. CCPA is opt-out: a business may collect and use personal information unless the consumer specifically opts out (with some exceptions for sensitive categories under CPRA).
Who is covered?
GDPR covers any organization processing personal data of EU residents, regardless of organization size. CCPA covers for-profit businesses meeting thresholds: $25M+ in revenue, or processing data of 100,000+ California consumers, or deriving 50%+ of revenue from selling personal information.
Ready to put this into practice?
Tell us about your business and we will scope a starter engagement or recommend a better starting point, typically within one business day. No obligation, no high-pressure sales call.