What is the primary objective of **CCPA**?

**The primary objective of the CCPA is to grant California residents enforceable rights over their personal information held by businesses.** Enacted in 2018 and effective January 1, 2020, as amended by the CPRA effective January 1, 2023, it provides rights to know, delete, opt-out of sales/sharing, correct, and limit use of sensitive personal information, while requiring businesses to implement notices, data inventories, and reasonable security.

Who is legally or professionally required to comply with **CCPA**?

**For-profit businesses doing business in California that meet any statutory threshold during the preceding calendar year must comply with CCPA.** Thresholds include annual gross revenues exceeding **$25 million** (adjusted to $26.625 million in 2025), buying/selling/sharing personal information of **100,000+** California consumers/households/devices annually, or deriving **50%+** of revenue from such activities. This applies extraterritorially to entities collecting California residents' data.

Does **CCPA** require an external audit or third-party certification?

**No, CCPA does not mandate external audits or third-party certification.** Businesses must implement reasonable security practices and maintain records of consumer requests for 24 months, but enforcement relies on CPPA investigations, subpoenas, and self-assessments. High-revenue entities face phased cybersecurity audits starting 2028, with internal audits recommended for demonstrable compliance.

How often should an assessment for **CCPA** be performed?

**CCPA assessments should be performed annually to confirm thresholds and compliance gaps.** Data inventories, gap analyses, and risk assessments for high-risk processing (e.g., sensitive personal information) are required by 2026 under CPRA, with ongoing monitoring for regulatory changes, consumer request metrics, and vendor contracts to ensure continuous adherence.

What are the consequences of non-compliance with **CCPA**?

**Non-compliance with CCPA incurs civil penalties of up to **$2,500** per unintentional violation and **$7,500** per intentional violation (adjusted to $2,663/$7,988 in 2025), enforced by the CPPA and California Attorney General.** A private right of action applies to data breaches of non-encrypted personal information, awarding **$100-$750** per consumer per incident, plus injunctive relief, remediation costs, and reputational damage.

An **CCPA** be mapped to other international frameworks?

**Yes, CCPA consumer rights and obligations map closely to frameworks like GDPR.** CCPA's rights to know, delete, and opt-out align with GDPR's access, erasure, and objection rights; data minimization, purpose limitation, and vendor contracts overlap, enabling unified programs despite CCPA's opt-out focus versus GDPR's consent emphasis.

What is the first step to begin implementing **CCPA**?

**The first step to implement CCPA is conducting a legal applicability assessment and data inventory.** Evaluate thresholds ($25M revenue, 100K+ consumers/devices, 50% revenue from sales/sharing), then map personal information flows, categories, retention, and third-party recipients to identify gaps in notices, request handling, and security.

What is the primary objective of **LGPD**?

**The primary objective of LGPD is to protect the fundamental rights of privacy and freedom of natural persons by establishing rules for the processing of personal data.** Enacted as Law No. 13.709/2018 on August 14, 2018, LGPD unifies Brazil's data protection framework, mandating 10 core principles including purpose limitation, necessity, transparency, security, prevention, non-discrimination, and accountability (Art. 6). It empowers data subjects with rights to access, correction, deletion, portability, anonymization, and objection to automated decisions (Art. 18), while imposing obligations on controllers and operators.

Who is legally or professionally required to comply with **LGPD**?

**All organizations processing personal data of Brazilian residents must comply with LGPD, regardless of size or location.** Its extraterritorial scope (Art. 3) applies to any data processing in Brazil, targeting Brazilian residents for goods/services, or collected in Brazil. Controllers (deciding purposes/means, Art. 5 VI) and operators (processing on instructions, Art. 5 VII) in public/private sectors bear duties; no employee/revenue thresholds exempt entities.

Does **LGPD** require an external audit or third-party certification?

**LGPD does not mandate external audits or third-party certification.** The ANPD conducts audits and enforces via graduated sanctions (Art. 55), but organizations must maintain internal records of processing activities (RoPAs, Art. 37), conduct DPIAs for high-risk activities (Art. 38), and demonstrate accountability through governance like DPO appointment (Art. 41, with public disclosure).

How often should an assessment for **LGPD** be performed?

**LGPD assessments, including RoPAs and DPIAs, must be maintained continuously and updated for changes in processing.** ANPD regulations require ongoing monitoring; DPIAs for high-risk activities like legitimate interests (Art. 38) are performed as needed, with incident logs retained 5 years. Quarterly internal audits and annual reviews align with best practices for evolving risks.

What are the consequences of non-compliance with **LGPD**?

**Non-compliance with LGPD incurs graduated ANPD sanctions up to 2% of Brazilian revenue per infraction (capped at R$50 million).** Penalties (Art. 52) include warnings, daily fines, publicity of infractions, data blocking/deletion, and suspensions up to 6 months (extendable); factors consider gravity, cooperation, and safeguards. Civil claims for damages (Art. 42) add liability.

Can **LGPD** be mapped to other international frameworks?

**Yes, LGPD can be mapped to other international frameworks due to shared principles like purpose limitation and data minimization.** Its 10 principles, 10 legal bases (Art. 7), and rights (Art. 18) align closely with global regimes, enabling hybrid programs; cross-border transfers use mechanisms like ANPD-approved SCCs (Resolution CD/ANPD No. 19/2024, mandatory by August 23, 2025).

What is the first step to begin implementing **LGPD**?

**The first step to implement LGPD is appointing a Data Protection Officer (DPO) and conducting data mapping for a Record of Processing Activities (RoPA).** Secure executive sponsorship, then inventory data flows, purposes, legal bases, and risks (Art. 37), prioritizing high-risk/sensitive data to enforce principles and enable DPIAs.

CCPA vs LGPD | GRADUM

Standards Comparison

CCPA

Mandatory

2020

California regulation granting consumers data privacy rights

LGPD

Mandatory

2020

Brazil's comprehensive regulation for personal data protection.

Quick Verdict

CCPA grants California residents rights to know, delete, and opt-out of personal data sales by qualifying businesses, while LGPD mandates lawful bases and data subject rights for all processing Brazilian data. Companies adopt CCPA for CA compliance and LGPD for Brazilian market access.

Data Privacy

CCPA

California Consumer Privacy Act (CCPA/CPRA)

Cost

€€€€

Complexity

High

Implementation Time

6-12 months

Key Features

Consumer rights to know, delete, opt-out, correct, limit sensitive PI
Applies to businesses with $25M revenue or 100K+ CA consumers/devices
Mandates notices at collection and 'Do Not Sell/Share' links
Enforcement fines up to $7,500 per intentional violation
Private right of action for data breaches with statutory damages

Data Privacy

LGPD

Lei Geral de Proteção de Dados Pessoais (Law 13.709/2018)

Cost

€€€€

Complexity

High

Implementation Time

12-18 months

Key Features

Extraterritorial scope targeting Brazilian residents' data
10 core principles including prevention and non-discrimination
Comprehensive data subject rights with anonymization option
Mandatory DPO appointment and DPIAs for high-risk processing
ANPD-enforced fines up to 2% Brazilian revenue

Detailed Analysis

A comprehensive look at the specific requirements, scope, and impact of each standard.

CCPA Details

What It Is

California Consumer Privacy Act (CCPA), as amended by CPRA, is a state regulation establishing consumer privacy rights for California residents. It applies extraterritorially to for-profit businesses meeting thresholds like $25M revenue or handling data of 100K+ consumers/devices. Primary purpose: empower consumers with control over personal information (PI) via rights-based approach, including opt-out of sales/sharing and limits on sensitive PI.

Key Components

Core consumer rights: know/access, delete, opt-out sale/share, correct, limit sensitive PI use, non-discrimination.
Obligations: notices at collection, privacy policies, DSAR handling within 45 days, vendor contracts, GPC honoring.
Enforcement by CPPA and AG with fines up to $7,500/violation; private action for breaches.
No certification; compliance via documented practices.

Why Organizations Use It

Mandatory for qualifying businesses to avoid fines, litigation, reputational harm. Provides data governance, efficiency, trust-building, GDPR alignment, market differentiation.

Implementation Overview

Phased: scoping/gap analysis (0-3 months), policies/contracts (1-4 months), technical controls (2-6 months), operationalization/training, audits. Targets data-heavy industries globally; cross-functional, tech-intensive for enterprises.

LGPD Details

What It Is

LGPD (Lei Geral de Proteção de Dados Pessoais, Law No. 13.709/2018) is Brazil's comprehensive data protection regulation. It safeguards personal data of natural persons with extraterritorial scope, applying to any processing targeting Brazilian residents. Modeled on GDPR but with Brazilian adaptations, it uses a risk-based approach emphasizing accountability and data minimization.

Key Components

10 core principles (purpose limitation, necessity, transparency, security, prevention, non-discrimination, accountability).
Data subject rights (access, correction, deletion, portability, objection to automated decisions).
Legal bases for processing (10 options including consent, legitimate interests).
Governance via mandatory DPO for controllers, DPIAs for high-risk activities, enforced by ANPD with graduated sanctions up to 2% Brazilian revenue (R$50M cap).

Why Organizations Use It

Legal compliance mandatory for entities processing Brazilian data.
Mitigates fines, reputational damage, operational disruptions.
Builds trust, enables market access in Brazil's digital economy.
Enhances security, supports innovation via anonymization exemptions.

Implementation Overview

Phased approach: governance setup, data mapping/RoPA, policies, technical controls, DSR/incident processes, monitoring. Applies to all sizes/industries with Brazilian nexus; no certification but ANPD audits/enforcement.

Key Differences

Aspect	CCPA	LGPD
Scope	Consumer rights over personal info for CA residents	Personal data processing with 10 principles for Brazilians
Industry	All for-profit meeting thresholds, CA-focused	All sectors processing Brazilian data, no size threshold
Nature	Mandatory state regulation with CPPA enforcement	Mandatory federal law enforced by ANPD
Testing	Internal audits, cybersecurity audits for large firms	DPIAs for high-risk, continuous monitoring required
Penalties	$2,500-$7,500 per violation, private breach actions	Up to 2% Brazilian revenue (R$50M cap) per infraction

Scope

CCPA

Consumer rights over personal info for CA residents

LGPD

Personal data processing with 10 principles for Brazilians

Industry

CCPA

All for-profit meeting thresholds, CA-focused

LGPD

All sectors processing Brazilian data, no size threshold

Nature

CCPA

Mandatory state regulation with CPPA enforcement

LGPD

Mandatory federal law enforced by ANPD

Testing

CCPA

Internal audits, cybersecurity audits for large firms

LGPD

DPIAs for high-risk, continuous monitoring required

Penalties

CCPA

$2,500-$7,500 per violation, private breach actions

LGPD

Up to 2% Brazilian revenue (R$50M cap) per infraction

Frequently Asked Questions

Common questions about CCPA and LGPD

CCPA FAQ

LGPD FAQ

You Might also be Interested in These Articles...

ISO 27701 Standalone Certification in 2025: Debunking Myths and Navigating the New Reality

Debunk myths on ISO 27701 standalone certification post-2025. Clarify viability, accreditation bodies, ISO 27001 audit differences & procurement benefits. Guide

Asset-Backed Issuers and SEC Cybersecurity Rules: Applicability, Disclosures, and Compliance Roadmap

How SEC cybersecurity rules apply to asset-backed issuers (ABS): Form 10-D disclosures, ABS-EE risk management, Inline XBRL tagging, exemptions. Roadmap for tru

ISO 27701 2025 Update: Navigating Standalone Certification Myths, Audit Realities, and a 90-Day PIMS Launch Plan

Debunk ISO 27701 2025 standalone certification myths vs ISO 27001. Get a 90-day PIMS launch roadmap, checklists & audit prep to certify faster amid global priva

Run Maturity Assessments with GRADUM

Transform your compliance journey with our AI-powered assessment platform

Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.

100+ Standards & Regulations

AI-Powered Insights

Collaborative Assessments

Actionable Recommendations

Check out these other Gradum.io Standards Comparison Pages

OSHA vs HIPAA

Discover OSHA vs HIPAA: Compare workplace safety standards with health data privacy rules. Master compliance, cut risks & penalties. Unlock expert insights now!

K-PIPA vs ISO 27701

Discover K-PIPA vs ISO 27701: Korea's consent-centric law with CPOs, 72h breaches, 3% fines meets global PIMS cert for controls, audits. Align for compliance mastery.

ISO 27701 vs U.S. SEC Cybersecurity Rules

Unlock ISO 27701 privacy controls vs U.S. SEC cybersecurity rules. Compare governance, risk management & compliance strategies for integrated protection. Align now for audit-ready resilience.

CCPA

LGPD

Quick Verdict

CCPA

Key Features

LGPD

Key Features

Detailed Analysis

CCPA Details

What It Is

Key Components

Why Organizations Use It

Implementation Overview

LGPD Details

What It Is

Key Components

Why Organizations Use It

Implementation Overview

Key Differences

Scope

Industry

Nature

Testing

Penalties

Frequently Asked Questions

CCPA FAQ

What is the primary objective of CCPA?

Who is legally or professionally required to comply with CCPA?

Does CCPA require an external audit or third-party certification?

How often should an assessment for CCPA be performed?

What are the consequences of non-compliance with CCPA?

An CCPA be mapped to other international frameworks?

What is the first step to begin implementing CCPA?

LGPD FAQ

What is the primary objective of LGPD?

Who is legally or professionally required to comply with LGPD?

Does LGPD require an external audit or third-party certification?

How often should an assessment for LGPD be performed?

What are the consequences of non-compliance with LGPD?

Can LGPD be mapped to other international frameworks?

What is the first step to begin implementing LGPD?

You Might also be Interested in These Articles...

ISO 27701 Standalone Certification in 2025: Debunking Myths and Navigating the New Reality

Asset-Backed Issuers and SEC Cybersecurity Rules: Applicability, Disclosures, and Compliance Roadmap

ISO 27701 2025 Update: Navigating Standalone Certification Myths, Audit Realities, and a 90-Day PIMS Launch Plan

Run Maturity Assessments with GRADUM

Check out these other Gradum.io Standards Comparison Pages

OSHA vs HIPAA

K-PIPA vs ISO 27701

ISO 27701 vs U.S. SEC Cybersecurity Rules