Compliance Guides

GDPR protects the personal data of people in the EU/EEA and applies to any organisation processing that data, wherever the organisation is based; the CCPA protects the personal information of California residents and only applies to businesses meeting its thresholds (broadly, over $25m annual revenue, or handling the personal information of large numbers of California consumers, or earning significant revenue from selling/sharing it). GDPR is consent-and-lawful-basis led with fines up to €20m or 4% of global annual turnover (Article 83); the CCPA is disclosure-and-opt-out led. Many businesses must comply with both.

No. The EU AI Act and GDPR apply together and cover different things. GDPR governs the protection and processing of personal data; the EU AI Act governs the development, provision, and use of AI systems and general-purpose AI models placed on the EU market. An AI system that processes personal data must satisfy both at once — the AI Act does not exempt you from GDPR, and GDPR does not by itself cover AI-specific risks like prohibited practices or high-risk-system obligations.

Work through where your users and operations are: if you process the personal data of anyone in the EU/EEA, GDPR applies (regardless of where you are based); if you handle the personal information of California residents and meet the CCPA thresholds, the CCPA applies; if you develop, deploy, or place an AI system on the EU market, the EU AI Act applies; and if you run an online platform or intermediary serving EU users, the DSA may apply. These overlap — most online businesses fall under more than one, so map each before assuming you are covered.

The EU AI Act regulates AI systems themselves — banning certain practices, imposing obligations on high-risk systems and general-purpose AI models, and setting transparency duties for things like chatbots and synthetic media. The Digital Services Act (DSA) regulates online platforms and intermediaries — how they handle illegal content, notice-and-action, advertising transparency, and (for very large platforms) systemic-risk assessments. One targets the AI you build or use; the other targets the platform you run. A company can fall under both, for example an online marketplace that also uses an AI recommender.

Quite possibly, yes. GDPR has extraterritorial reach: it applies to any organisation, anywhere, that offers goods or services to people in the EU/EEA or monitors their behaviour. A US or UK company with EU customers, EU website visitors it tracks, or EU users it markets to generally falls in scope. Being outside the EU does not exempt you; if you target or monitor people in the EU, you need a lawful basis, transparency, and the data-subject-rights processes GDPR requires.

Partly, but not automatically. A strong GDPR programme covers much of what the CCPA needs — data inventories, transparency notices, and individual rights handling — so it is a head start. But the CCPA has distinct requirements GDPR does not, notably a clear 'Do Not Sell or Share My Personal Information' mechanism, specific notice-at-collection wording, and its own definitions and thresholds. Treat GDPR compliance as a foundation, then close the CCPA-specific gaps rather than assuming one covers the other.