Privacy readiness assessment: GDPR, CCPA and US state laws

Not in the way the phrase suggests. No regulator certifies a company as GDPR- or CCPA-compliant. GDPR allows for approved certification schemes and codes of conduct, but they are optional, few organizations use them, and none replaces compliance itself. The CCPA and the other state laws have no certification at all. What customers and regulators look for is evidence: records of processing, assessments, contracts, accurate notices and a rights-request process that works.

The Data Privacy Framework is one lawful way for a US company to receive personal data from the EU, backed by a European Commission adequacy decision, with UK and Swiss counterparts. A company joins by self-certifying to the US Department of Commerce and committing to the framework’s principles — no outside firm can certify you into it. Readiness checks that your practices, privacy notice and recourse mechanism meet those principles before you file. Because the framework has faced legal challenges, many companies also keep Standard Contractual Clauses in place as a fallback.

It can. GDPR applies to organizations outside the EU that offer goods or services to people in the EU, even free ones, or that monitor their behavior there, for example through tracking and profiling. If you do, you may also need to appoint a representative in the EU. And if you process data for EU business customers, they will require GDPR terms in your contract regardless of where you are based.

It depends on where your consumers live, how many of them you process data about, and whether you sell personal data or earn revenue from it. California’s law applies based on revenue, the volume of consumer data you buy, sell or share, or the share of revenue that comes from selling or sharing it. Most other state laws use thresholds tied to the number of residents whose data you process, and some, like Texas’s, reach nearly any business that isn’t a small business. Readiness starts with an applicability analysis, then builds one program that meets the strictest common requirements instead of a separate effort per state.

California has adopted regulations under the CCPA that require businesses whose processing presents significant risk to consumers’ privacy to conduct and document risk assessments, require certain businesses to complete an independent cybersecurity audit, and set rules for automated decision-making technology. The obligations phase in by business size and type. The cybersecurity audit must be performed by a qualified, objective and independent auditor; readiness prepares the program, documentation and evidence that audit will examine, and gets your risk assessments written.

The two regimes run in opposite directions. In the EU and UK, non-essential cookies and similar technologies generally need prior consent. In California and most other states, sharing data for targeted advertising is allowed by default, but people must be able to opt out, and several states, California and Colorado among them, require you to honor browser-based opt-out preference signals such as Global Privacy Control. A readiness review compares what your tags and SDKs actually do with what your banner and notice say.

Every privacy law requires reasonable security for personal data, so security evidence is part of privacy evidence. A SOC 2 report can include the Privacy criteria, ISO/IEC 27701 sets out a privacy information management system alongside ISO 27001, and penetration testing shows whether the applications holding personal data are as protected as your notices claim. Readiness connects the two, so one body of evidence answers both the privacy questionnaire and the security one.