A small online shop receives a deletion request and cannot say where the customer’s data sits. Data protection compliance starts with knowing which laws apply and mapping where personal data lives, then adding controls, notices and a breach plan.
The checklist below corrects the assumptions that most often leave gaps. For the wider legal picture, read our guide to data privacy laws explained.
Which laws apply to your business
Misconception: one law covers every business. Dataversity notes that many data laws apply only to specific industries, such as healthcare or finance, or to firms operating in Europe or other regions. The CCPA applies to companies that do business in California. Your list of applicable laws therefore depends on your sector and on where you operate and serve people. Write that list down and tie each law to the processing activities it touches.
GDPR and CCPA are the two regimes businesses most often compare. They overlap on individual rights but differ in how penalties are framed.
| Topic | GDPR | CCPA | Planning use |
|---|---|---|---|
| Individual rights | Access, correct, erase or withdraw consent for use of data | View or delete personal data and stop its sale | Build one request intake that can route every one of these actions |
| What the business must offer | Processes that let individuals exercise those rights | Accessible options to opt in or out of data sales, plus ways to request access | If you sell or share data, put the opt-out where customers can find it |
| Maximum penalty | Up to EUR 20 million or 4% of global revenue, whichever is higher | Up to USD 7,500 per violation | Treat both as ceilings for risk ranking, not forecasts of what a fine will be |
Penalty ceilings and CCPA rights are drawn from Fidelis Security’s compliance overview, and GDPR individual rights and CCPA opt-out duties from Perforce’s regulation guide.
Mapping data before anything else
Misconception: the team already knows where its data is. DataGuard recommends a comprehensive data audit as the starting point, to identify the sensitive information an organisation holds and where it is stored. Enov8 adds the operational reason: organisations must keep visibility into where personal data exists so they can respond to requests efficiently. Without a map, a deletion or access request becomes a search through every system.
Build the map by use case, such as marketing, payroll or analytics, so the business owner of each activity can confirm it is accurate. For each flow, record these points:
- Data types and legal basis. Note what is collected and whether processing rests on consent, contract or another basis.
- Retention and recipients. Record how long data is kept and which vendors or partners receive it.
- Risk rating. A simple low, medium or high score tied to potential harm tells you which flows get controls and audits first.
Re-check the map whenever a system or vendor changes, and review new data-heavy technology before launch. Systems that collect data at scale, such as those described in AI Surveillance Technology: What It Is, How It Works, and Why It Matters in 2026 – Technopolicy, belong on the map from day one.
Security controls, policies and people
Misconception: buying a security tool settles compliance. Controls only count when policy, people and technology line up. These are the pieces the evidence supports:
- Encryption and access controls. DataGuard calls these crucial for protecting sensitive data. Pair them with least-privilege roles so staff reach only the data their job needs.
- Written policies and training. DataGuard advises clear policies on data handling, access and sharing, backed by regular staff training. Staff who can spot and escalate a rights request protect your response deadlines.
- A Data Protection Officer and impact assessments. DataGuard also advises designating a Data Protection Officer and running regular data protection impact assessments. Whether the role is mandatory depends on the national law that applies to you.
- Privacy by design. Perforce describes this as taking a proactive approach to privacy and protection laws while products and systems are developed, rather than patching problems afterwards.
Vendors deserve the same scrutiny, because the map shows which of them touch personal data. Ask for proof of their controls and keep a record of what each one is allowed to do.
Notices, consent and individual requests
Misconception: a privacy policy on the website is enough. A notice only works if the business can act on what it promises. Under the CCPA, residents gain access, opt-out of collection and deletion rights, according to Enov8. GDPR individuals can access, correct, erase or withdraw consent, per Perforce.
Turn those rights into a repeatable workflow:
- Publish a short, plain-language notice stating purpose, retention and contact details, with a link to the fuller policy.
- Record each consent event and make withdrawal as easy as giving consent.
- Log every request in one place, verify the requester’s identity and route it to the data owner named in your map.
- Submit a mock request now and then and review how complete and timely the response was.
Where you sell personal data, the CCPA expects accessible opt-in or opt-out choices for consumers, as Perforce summarises. Accessible means visible without hunting through account settings.
Breach response and enforcement
Misconception: breach handling begins when a breach happens. Fidelis advises maintaining a comprehensive incident response plan before any incident, so the organisation can address a data breach quickly and limit its impact. A usable plan names roles, notification thresholds, applicable legal timelines and communication templates, and includes a lessons-learned step afterwards.
Notification duties differ by sector and region. In the United States, Dataversity reports that financial institutions must notify the FTC of breaches affecting at least 500 customers, under a rule it dates to May 13, 2024. Check the deadlines in data breach notification laws against the jurisdictions on your law list.
Speed and conduct after a breach shape enforcement. DataGuard lists promptness in reporting, actions taken to reduce damage and cooperation with regulators among the factors affecting GDPR fines. That makes the ceiling in the table above the extreme case, and your response record a real lever. The CCPA figure is per violation, so exposure also depends on how many violations are counted.
On the GDPR side, each EU member state has its own data protection authority, which Perforce describes as the enforcer of GDPR within the European Union. It supervises, investigates and applies the rules. Identify the authority for each country where you operate and keep its contact route in the incident runbook.
Frequently asked questions
| Question | Answer |
|---|---|
| Does the GDPR ceiling mean every fine is that large? | No. It is a maximum. Factors such as how promptly a breach is reported, the steps taken to reduce damage and cooperation with regulators affect the outcome, according to DataGuard. |
| Who enforces the GDPR? | A separate data protection authority in each EU member state supervises, investigates and applies it. |
| Do I need a Data Protection Officer? | DataGuard advises designating one to support compliance. Whether it is legally required depends on the laws that apply to your business. |
| Is compliance a one-off project? | No. Maps, vendor lists and incident plans go stale when systems, vendors or laws change, so each needs a named owner and regular review. |
