Who needs to comply with the GDPR?
The GDPR applies to organizations established in the EU and to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior. A US company with European customers or users can be in scope even with no office there.
It requires a lawful basis for processing, transparency, respect for individual rights, appropriate security, breach notification and records that show accountability.
Who needs to comply with the CCPA?
The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenue above the inflation-adjusted amount set in the law, buying, selling or sharing personal information of 100,000 or more California consumers or households, or earning half or more of annual revenue from selling or sharing personal information.
It gives consumers rights to know, delete, correct and opt out of the sale or sharing of their data, and it requires reasonable security. California regulations that took effect in January 2026 add cybersecurity audit and risk assessment requirements for certain businesses, phased in over several years.
What is a Data Protection Impact Assessment?
A DPIA is a documented assessment, required by GDPR Article 35, for processing that is likely to result in a high risk to people's rights and freedoms. Common triggers include large-scale processing of sensitive data, systematic monitoring and new technologies such as AI.
It describes the processing, assesses necessity and proportionality, identifies the risks to individuals and records the measures that reduce them. It should be done before the processing starts and revisited when the processing changes.
What we do
We assess how your organization collects, stores, uses and shares personal data, compare your security controls, policies and procedures with GDPR and CCPA requirements, and give you a plan to close the gaps. We work iteratively so compliance keeps pace as your products and data use change.
We conduct DPIAs with independent, practical recommendations. Privacy law involves legal interpretation, so we coordinate with your counsel on legal questions while we handle the technical and governance work.
