GDPR vs CCPA

The short answer

GDPR starts from "you may not use personal data unless you have a lawful reason." The CCPA starts from "you may use it, but people can see it, delete it and stop you from selling or sharing it."

For a SaaS buyer, both shape the contracts you sign with vendors. GDPR asks for a DPA with each processor. The CCPA asks for a written contract with each service provider.

GDPR

• Who it covers: companies in the EU, and companies outside the EU that offer goods or services to people in the EU or monitor their behavior there (Article 3). There is no revenue threshold.
• Core rule: processing is lawful "only if and to the extent that" one of six legal bases applies, such as consent, a contract or legitimate interests (Article 6).
• Roles: controllers and processors. Processors must work under a contract that meets Article 28.
• Transfers: sending data outside the EU needs a valid route, such as an adequacy decision or SCCs (Article 44).
• Fines: up to 20 million euros or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches (Article 83(5)).

CCPA

• Who it covers: for-profit businesses that collect personal information of California residents and meet a threshold. The California Privacy Protection Agency lists gross annual revenue of $26.625 million or more (in effect since January 1, 2025), buying, selling or sharing data of 100,000 or more California residents or households, or earning 50% or more of revenue from selling or sharing it.
• Who it protects: a "consumer," defined as "a natural person who is a California resident" (1798.140(i)). The agency says this includes employees, job applicants and business contacts (CPPA FAQ).
• Core rule: notice plus rights. People can ask to know, delete and correct their data, limit the use of sensitive data, and they have "the right to opt out of sale or sharing" (1798.120(a)). See selling vs sharing.
• Roles: businesses, service providers, contractors and third parties. A service provider processes personal information on a business's behalf under a written contract (1798.140(ag)).
• Signals: businesses must honor opt-out preference signals such as Global Privacy Control (CPPA FAQ).

Which one applies to you

A US SaaS company can be subject to both, in different ways.

• GDPR: applies directly if you have an office in the EU, or if you offer your product to people in the EU or track their behavior there (Article 3). If you are a vendor to EU companies, they will also ask you to sign a DPA that passes GDPR duties on to you. Size does not matter.
• CCPA: applies directly only if you meet one of its thresholds. Even below them, your bigger customers may ask you to sign CCPA service provider terms.
• Your vendors: check that each vendor's DPA covers both, for example with a GDPR section and a separate CCPA or US state law section.
• Other states: California is not alone. See US state privacy laws.

The biggest practical difference for vendor reviews: under GDPR, your vendor needs your written authorization before it adds subprocessors, and must tell you about changes so you can object (Article 28(2)). The CCPA focuses on what your service provider may and may not do with the data.

Example

Venpo flagged a change where Klaviyo no longer promises to pass privacy requests on to you. Both laws give people rights to make requests about their data, so a vendor's promise to forward those requests matters under GDPR and the CCPA alike.

For example, imagine a Texas startup with 40 employees and $5 million in revenue that sells to EU companies. GDPR likely applies to the data of its EU users and contacts, because it offers its product to people in the EU. The CCPA may not apply directly, but a California customer may still ask it to sign service provider terms. Its vendors would need to support both sets of terms too.

How Venpo helps

Venpo monitors your vendors' DPAs, privacy policies and subprocessor lists, and emails a plain-English alert when their GDPR or CCPA wording changes. The Fine Print Scan also answers whether each vendor sells your data or uses it for ads, and how long it keeps data.