CCPA
California regulation granting consumers data privacy rights
EN 1090
EU standard for steel and aluminium structural execution
Quick Verdict
CCPA mandates data privacy rights for California residents, enforced by fines, while EN 1090 requires certified execution of structural metal components for EU market access via CE marking. Companies adopt CCPA to avoid penalties and build trust; EN 1090 for legal sales compliance.
CCPA
California Consumer Privacy Act (CCPA/CPRA)
Key Features
- Grants consumers rights to know, delete, correct, opt-out of sales/sharing
- Applies to businesses with $25M revenue or 100K+ CA consumers/devices
- Mandates notices at collection and Do Not Sell/Share links
- Requires honoring Global Privacy Control signals frictionlessly
- Imposes $7,500 fines per intentional violation by CPPA/AG
EN 1090
EN 1090 Execution of steel and aluminium structures
Key Features
- Risk-based Execution Classes (EXC1-EXC4)
- Factory Production Control (FPC) certification
- CE marking via Notified Body audits
- Welding quality aligned with ISO 3834
- Material traceability and NDT inspection
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
CCPA Details
What It Is
California Consumer Privacy Act (CCPA), as amended by California Privacy Rights Act (CPRA), is a state regulation establishing consumer data privacy rights for California residents. It targets for-profit businesses meeting thresholds like $25M revenue or handling 100K+ consumers' data, using a rights-based approach focused on transparency, opt-outs, and data minimization.
Key Components
- Core consumer rights: know/access, delete, correct, opt-out sales/sharing, limit sensitive data
- Obligations: notices at collection, privacy policies, DSAR handling (45-90 days), vendor contracts
- Enforcement by CPPA with $2,500-$7,500 per violation fines; private breach actions
- No certification; compliance via audits, risk assessments (2026 for high-risk)
Why Organizations Use It
- Mandatory for qualifying businesses to avoid multimillion fines (e.g., $85M settlements)
- Builds consumer trust, reduces breach risks ($9.48M avg cost)
- Enables multi-state compliance, competitive differentiation via privacy-by-design
- Strategic ROI: 75% faster DSARs, 40% incident reduction
Implementation Overview
Phased: scope/gap analysis (0-3 months), policies/contracts (1-4 months), tech/automation (2-6 months), training/audits (ongoing). Applies globally to CA data handlers; cross-functional teams essential for data mapping, GPC integration.
EN 1090 Details
What It Is
EN 1090 is a harmonized European standard family for the execution and conformity assessment of structural steel and aluminium components. It implements the EU Construction Products Regulation (CPR), enabling CE marking for load-bearing metal structures in construction. The risk-based approach scales requirements via Execution Classes (EXC1-EXC4) linked to failure consequences, service conditions, and production complexity.
Key Components
- **EN 1090-1Conformity assessment, Factory Production Control (FPC), and Declaration of Performance (DoP).
- **EN 1090-2/-3Technical rules for steel/aluminium execution (welding, tolerances, corrosion protection, inspection).
- Core principles: traceability, welding quality (ISO 3834), NDT inspection; certified by Notified Bodies via AVCP systems.
Why Organizations Use It
- Mandatory for EU market access and CE marking.
- Reduces liability, rework, and ensures structural safety.
- Builds trust with clients, enables high-risk projects, and aligns with Eurocodes.
Implementation Overview
Phased: gap analysis, FPC development, personnel training, Notified Body certification, ongoing surveillance. Targets fabricators in construction; 3-12 months typical, with audits for EXC2+.
Key Differences
| Aspect | CCPA | EN 1090 |
|---|---|---|
| Scope | Consumer data privacy rights and obligations | Structural steel/aluminium fabrication and conformity |
| Industry | All sectors handling CA residents' data, US-focused | Construction/metal fabrication, EU/EEA mandatory |
| Nature | State privacy regulation with fines | Harmonized standard for CE marking certification |
| Testing | DSAR processes, security audits, no formal certification | FPC certification, NB audits, ongoing surveillance |
| Penalties | $2,500-$7,500 per violation plus breach lawsuits | Market exclusion, no CE marking, certificate suspension |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about CCPA and EN 1090
CCPA FAQ
EN 1090 FAQ
You Might also be Interested in These Articles...
Beyond Reactive: Transforming Compliance into Real-Time Threat Prevention
Discover how modern compliance monitoring tools leverage continuous, real-time oversight and automated alerts to shift organizations from reactive problem-solving to proactive threat detection and prevention, safeguarding against emerging risks before they escalate.
Top 10 NIST CSF 2.0 Myths Busted: Separating Hype from Reality for Smarter Adoption
Bust 10 NIST CSF 2.0 myths like 'only for critical infrastructure' or 'Govern replaces Identify'. Plain-English breakdowns, evidence, and fixes for flexible ris
Top 5 Unseen Complexities Modern Compliance Software Effortlessly Manages
Uncover top 5 unseen complexities modern compliance software manages effortlessly—from sensitive data mapping to real-time regulatory shifts. Automate audits, i
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
OSHA vs MLPS 2.0 (Multi-Level Protection Scheme)
Explore OSHA vs MLPS 2.0: US workplace safety meets China's cybersecurity scheme. Uncover gaps, strategies & implementation for global compliance mastery. Dive in now!
MLPS 2.0 (Multi-Level Protection Scheme) vs ISO 22301
Compare MLPS 2.0 vs ISO 22301: China's graded cybersecurity meets global business continuity. Discover differences, compliance gaps, and strategies for resilient ops now.
K-PIPA vs UAE PDPL
Compare K-PIPA vs UAE PDPL: Korea's consent-driven CPOs & 72h breaches vs UAE's GDPR-like DPOs, DPIAs & transfers. Key gaps, insights for global compliance mastery!