•  
  •  
 

Chapman Law Review

The Compliance Stack: A Structural Comparison of the GDPR and the CCPA

Abstract

Comprehensive privacy statutes now set the baseline terms for multinational data privacy compliance. Two regimes dominate the attention of scholars and practitioners—the European Union’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA)—yet the two are not the functional equivalents that corporate compliance discussions sometimes suggest. They differ in regulatory design, doctrinal architecture, and operative assumptions. This Article works through the primary sources to compare them across five dimensions: territorial scope, processing constraints, individual rights, crossborder transfer mechanisms, and enforcement. On transfers, the contrast is especially sharp. The GDPR carves out third-country data flows as a distinct legal question under chapter V, subjecting them to adequacy decisions, approved safeguards, or narrow derogations; the CCPA has no comparable regime and instead governs downstream disclosures through its sale-and-sharing rules and its taxonomy of service providers, contractors, and third parties. The Article’s aim is descriptive, seeking to isolate where these regimes align in practice and where their legal triggers diverge.

This document is currently not available here.

Share

COinS