Compare Privacy Regulations
Compare GDPR, CCPA, and PIPEDA side-by-side to understand their key differences and similarities.
Need inspiration from other industries? Explore Eclipse Journey - Eclipse travel planning companion to see how teams document regulatory differences in practice.
EU
GDPR
Jurisdiction: European Union
Effective: May 25, 2018
Applies to: All EU residents
CA
CCPA
Jurisdiction: California, USA
Effective: January 1, 2020
Applies to: California residents
CA
PIPEDA
Jurisdiction: Canada
Effective: April 13, 2000
Applies to: Canadian residents
| Feature | GDPR | CCPA | PIPEDA |
|---|---|---|---|
| Geographic Scope | EU residents worldwide | California residents only | Canadian residents |
| Consent Required | ✅ Explicit opt-in required | ⚠️ Opt-out for data sales | ✅ Meaningful consent required |
| Right to Access | ✅ Yes | ✅ Yes | ✅ Yes |
| Right to Deletion | ✅ "Right to erasure" | ✅ Yes, with exceptions | ✅ Yes, when appropriate |
| Data Portability | ✅ Yes | ❌ No | ⚠️ Limited |
| Breach Notification | 72 hours to authority | Private right of action | As soon as possible |
| DPO/Privacy Officer | ✅ Required for some | ❌ Not required | ⚠️ Recommended |
| Maximum Fine | €20M or 4% revenue | $7,500 per violation | $100K per violation |
| Age of Consent | 16 years (13-16 by member state) | 16 years | 13 years (provincial laws vary) |
| Cross-Border Transfers | Strict requirements | No specific requirements | Adequate protection required |
GDPR Highlights
- •Strictest consent rules: Requires explicit, granular consent
- •Data Protection Officer: Required for large-scale data processing
- •Privacy by design: Mandates privacy considerations in system design
- •Largest fines: Up to €20M or 4% of global revenue
CCPA Highlights
- •Opt-out model: Allows data collection unless user opts out
- •"Do Not Sell" requirement: Must provide clear opt-out link
- •No DPO required: Simpler organizational structure
- •Revenue thresholds: Only applies to larger businesses
PIPEDA Highlights
- •Oldest framework: In effect since 2000, most mature
- •Reasonable purposes: Focuses on legitimate business needs
- •Provincial variations: Some provinces have their own laws
- •Less prescriptive: More flexible interpretation
Which Regulation Applies to Your Business?
You Need GDPR If:
- ✓ You target EU residents
- ✓ You have EU customers/users
- ✓ You monitor EU behavior
You Need CCPA If:
- ✓ You do business in California
- ✓ You meet revenue/data thresholds
- ✓ You collect CA resident data
You Need PIPEDA If:
- ✓ You operate in Canada
- ✓ You have Canadian customers
- ✓ You cross provincial borders
Need Compliant Privacy Policies?
Generate GDPR, CCPA, and PIPEDA-compliant privacy policies with our easy-to-use generator.
Generate Privacy Policy