Two regulators.
One privacy program.

Because the GDPR is extraterritorial: it applies based on whose data you process, not where your company sits. If you offer goods or services to people in the EU or EEA, or monitor their behavior — signing up EU users, selling to EU customers, tracking EU visitors — you can fall under the GDPR with no office or entity in Europe. For a scaling tech company this happens earlier than most founders expect, often the first time an EU customer signs up or an EU enterprise prospect runs you through a data protection assessment.

The same logic applies to CCPA/CPRA, which reaches any qualifying business processing California residents' data regardless of location. So you usually don't get to choose whether these laws apply — your customers and users decide it the moment you serve them. The right response is to determine which regimes you've triggered and build a program that covers them, rather than assuming a U.S. address keeps you out of scope.

Mostly, but not entirely — and the gap is where companies get caught. Because the GDPR is generally the stricter framework, a genuine GDPR program satisfies most of the CCPA/CPRA baseline — data inventory, access and deletion rights, limited collection, vendor management. That's why organizations serving both markets anchor a unified program on the GDPR.

However, CCPA/CPRA has specific obligations the GDPR doesn't, and GDPR compliance doesn't create them for you: the "Do Not Sell or Share My Personal Information" link, a "Limit the Use of My Sensitive Personal Information" mechanism, financial-incentive disclosures, and California's newer risk-assessment and automated-decision rules. And it doesn't run the other way — a CCPA-only program leaves large GDPR gaps around lawful basis, consent, and cross-border transfers. GDPR gets you most of the way to CCPA, but you still close the California-specific items deliberately.

The updates effective January 1, 2026 are the most significant expansion of California privacy obligations since the CPRA amendments in 2023, and they push CCPA/CPRA closer to the GDPR. The headline additions: mandatory risk assessments for certain high-risk processing (paralleling GDPR's data protection impact assessments); annual cybersecurity audits for businesses meeting the thresholds; extended consumer access rights; and new protections for minors' data.

There's also a separate, later milestone: the obligations around automated decision-making technology for significant decisions — opt-out and access rights when automated systems, including AI, make consequential decisions about people — take effect January 1, 2027, not 2026, so don't treat those as already required. For a tech company, the practical impact is that California now expects documented, repeatable privacy governance — risk assessments before risky processing, and audit-ready security — not just notices and opt-out links. We help you build that documentation and the underlying processes so the new requirements are met and evidenced.

Because privacy compliance has become a procurement and due-diligence gate, not just a legal obligation. When you sell to a larger company, that customer is itself accountable for the data it shares with you, so its security and privacy teams assess whether you handle personal data lawfully before they sign — through data protection assessments, data processing terms, and questions about how you support data-subject and consumer rights. The same holds in fundraising and acquisition diligence, where unresolved EU and California privacy exposure can reduce valuation or stall a deal.

In other words, GDPR and CCPA/CPRA readiness increasingly determines whether you can close enterprise contracts and pass investor scrutiny, independent of the fines themselves. That makes a credible privacy program a revenue enabler, not a cost center: it shortens security reviews, unblocks deals, and signals operational maturity. We build the program and assemble the documentation those reviews ask for, so privacy stops slowing your deals down.