Differences Between GDPR, CCPA, and the PDP Law

Modern businesses are rarely truly “local.” Websites are accessible across borders, SaaS platforms serve global customers, employee data is stored in the cloud, and third-party vendors often operate in different jurisdictions.

Yet in many boardroom and management discussions, familiar assumptions still surface: “We’re only an Indonesian company.” “We don’t have an office in Europe.” “We’re not a big tech firm.”

Unfortunately, these assumptions are wrong. Data protection regulations are applied based on data flows: who the data subjects are, where data is processed, for what purpose, and how much control a company exercises over that data.

This is why many organizations are caught off guard during audits or regulatory investigations. Without realizing it, they may already be subject to multiple data protection regulation simultaneously, with little preparation and insufficient documentation.

What Are GDPR, CCPA, and the PDP Law?

GDPR, CCPA, and Indonesia’s PDP Law are data protection regulations originating from different jurisdictions, each with a distinct regulatory philosophy and compliance model.

GDPR (General Data Protection Regulation)

The GDPR is a European Union regulation that has been in force since 2018 and is widely regarded as the global gold standard for data protection.

It provides a comprehensive framework governing the collection, use, storage, and disclosure of personal data.

GDPR applies to any organization that processes personal data of individuals in the EU residents, regardless of where the organization itself is located.

Many companies in Asia, including Indonesia, fall under GDPR not because they have offices in Europe, but because they serve EU customers, users, or business partners.

CCPA (California Consumer Privacy Act)

The CCPA is a California state law in the United States that took effect in 2020 and is known for its strong “opt-out” model.

Its primary focus is consumer protection and transparency, particularly around the sale and sharing of personal data with third parties.

In practice, many digital businesses, SaaS providers, and e-commerce platforms are unaware that California user traffic alone may already trigger CCPA obligations.

PDP Law (Personal Data Protection Law)

The PDP Law is an Indonesian regulation enacted through Law of the Republic of Indonesia Number 27 of 2022 on Personal Data Protection and became fully enforceable on 17 October 2024.

It applies to all parties processing personal data within Indonesia, without exemptions based on company size or industry.

This means MSMEs, startups, and large corporations face the same compliance risk if they process personal data without proper governance and controls.

In reality, these regulations often overlap. A single customer database may contain EU residents, California consumers, and Indonesian citizens, each segment subject to different legal requirements.

Similarities Between GDPR, CCPA, and the PDP Law

Despite their differences, all three regulations pursue the same core objective: reducing the risk of personal data misuse and holding businesses accountable.

1. Personal Data Is a Risk-Bearing Asset

Under GDPR, CCPA, and the PDP Law, personal data is no longer treated as a mere operational input. It is a business asset that carries legal, reputational, and operational risk.

This means that the larger the volume and sensitivity of the data managed, the greater the business’s risk exposure.
Data breaches or unlawful processing are no longer just IT issues, they can directly become executive-level concerns.

2. Individuals Have Enforceable Rights Over Their Data

All three regulations emphasize the same thing: the data belongs to the individual, not to the company. Individuals have the right to know what data is collected, for what purpose, and how the data is used or shared.

Requests for access, correction, or deletion of data are no longer “polite requests,” but legal rights that businesses must respond to within defined timeframes.

3. Accountability Rests With the Company

GDPR, CCPA, and the PDP Law all place the compliance burden on the company, not on individuals or vendors.

Using SaaS platforms, cloud providers, or third-party vendors does not transfer responsibility. In audits or regulatory reviews, authorities do not ask who your vendor is, but they ask how you ensured compliant data handling and how you can prove it.

Differences Between GDPR, CCPA, and the PDP Law

The main differences lie in territorial scope, consent models, data subject rights, and sanctions, all of which directly affect business operations and system design. Below is a summary of the differences:

Scope and Area of Application

GDPR applies extraterritorially, CCPA is based on California, while the PDP Law focuses on processing activities in Indonesia.

GDPR has cross-country scope and can apply globally, depending on the location of the data subject and processing activities. It applies if a company offers products or services to individuals in the European Union or monitors their behavior.

CCPA applies if your company meets one of the following: annual revenue > $26.625 million, processes data (sells, buys, shares) of 50,000+ California consumers/households, or derives 50%+ revenue from selling California consumer data.

The PDP Law applies to data processing in Indonesia and also to processing outside Indonesia that has adverse impacts on Indonesian citizens or is conducted by Indonesian legal subjects.

For business owners, you may need to comply with two or more regulations simultaneously, meaning having different policies, procedures, and response mechanisms.

Types of Personal Data Protected

GDPR has the broadest definition of personal data, CCPA focuses on consumer data, while the PDP Law is in the middle with general and specific data classification.

GDPR defines Personal Data very broadly, covering any information that identifies an individual directly or indirectly.

For example, IP addresses, cookie IDs, GPS location data, and even documented shopping preferences. Under GDPR, these are personal data.

GDPR also categorizes Special Categories of Data such as health data, religious beliefs, and biometric data, whose processing is highly restricted.

CCPA emphasizes data that is “sold” or “shared”, including consumer behavioral and preference data. Activities like data sharing with ad networks are often high-risk points.

Meanwhile, the PDP Law clearly distinguishes General Personal Data and Specific Personal Data (equivalent to sensitive data). General personal data can include name, gender, to nationality.

Specific personal data covers health data, biometric data, financial data, to criminal records. Processing this type of data requires explicit consent and a higher level of security.

Data Subject Rights (User / Consumer)

GDPR provides the most comprehensive rights, CCPA focuses on opt-out rights, and the PDP Law adopts a fairly broad rights approach, though implementation is not yet fully realized.

GDPR offers the most comprehensive rights framework, including access, erasure, portability, objection, and safeguards against automated decision-making.

GDPR provides 8 main rights including the right of access, erasure (right to erasure), and data portability. Under GDPR, businesses must be ready to face requests for access, correction, deletion, restriction of processing, and data portability.

CCPA focuses on consumer rights related to data sales: the right to know, delete, opt-out, and receive equal service without discrimination. The “Do Not Sell My Personal Information” button is not just a formality, but a real obligation.

Indonesia’s PDP Law closely mirrors GDPR in structure, the PDP law grants right to access, correct, delete, withdraw consent, object to automated processing, and seek compensation through legal action.

In practice, many organizations, especially local businesses, are still unprepared to handle formal data subject requests within statutory deadlines.

Obligations of Data Controllers & Processors

These three regulations all impose obligations on data controllers and processors, but with different levels of depth of control and operational readiness.

GDPR applies the principle of Data Protection by Design & Default. This means all data processing activities need to consider data protection from the early stages. Business owners are required to have records of processing activities (ROPA), conduct Data Protection Impact Assessment (DPIA) for high-risk activities, and appoint a DPO when required.

CCPA emphasizes transparent notices to consumers at the point of collection and easy opt-out mechanisms (such as the “Do Not Sell My Personal Information” icon).

The PDP Law applies the principle of Privacy by Design & by Default. It requires the appointment of a Personal Data Protection Officer (PPDP/DPO), making a list of data processing activities, and reporting serious data breaches to the Ministry of Communication and Information (Kominfo) and data owners within 72 hours.

Legal Basis for Processing (Consent vs. Opt-out)

GDPR and the PDP Law tend to be consent and legal basis-based, while CCPA emphasizes the opt-out mechanism more.

GDPR relies on consent that is specific, informed, and can be withdrawn at any time. Consent is not always mandatory, but GDPR strongly demands a clear and documented legal basis.

CCPA uses an opt-out approach for data sale, where processing can be done as long as the consumer does not state refusal.

The PDP Law regulates consent explicitly (with 6 legal bases), with consent being one of them, but also recognizes legitimate interests and contractual obligations.

Sanctions and Fines

GDPR has the highest potential fines, CCPA combines fines and lawsuits, while the PDP Law combines administrative sanctions and criminal penalties.

GDPR can impose fines of up to 20 million euros or 4% of annual global turnover (whichever is higher). However, in practice, the biggest cost often comes from remediation and loss of trust.

CCPA allows fines of up to USD 7,500 per violation and civil lawsuits by consumers. One data breach could mean thousands of claims.

The PDP Law regulates administrative fines of up to 2% of turnover or IDR 5 billion (whichever is higher), compensation damages in civil lawsuits, and criminal imprisonment for certain perpetrators. Reputational risk and operational disruption are often far greater than the fine figures themselves.

Why Understanding GDPR, CCPA, and the PDP Law Matters

This understanding is important because data privacy compliance has become an operational prerequisite. Misidentifying applicable regulations risks financial penalties, operational disruption, and permanent reputational damage.

In the context of business expansion, global partners will ask for evidence of compliance before signing a contract. Your business deal worth billions of rupiah can be delayed for months because privacy due diligence fails.

For audits (whether internal, external, or regulatory), you will be asked for a data map (data mapping) and proof of fulfillment of data subject rights. Without documentation, this process will be very painful and costly.

Cooperation with foreign vendors is also increasingly complex. Many global SaaS platforms now offer special compliance addendums for GDPR or CCPA. Without understanding, you could agree to clauses that are actually burdensome legally in Indonesia.

In essence, businesses that understand the context of GDPR, CCPA, and the PDP Law can make risk-based decisions, not just a legal checklist.

Conclusion

GDPR, CCPA, and the PDP Law are not just three legal documents to memorize. They represent three different approaches to data privacy with real operational implications.

Data privacy compliance is about understanding and proving how data is used in business processes, who is responsible, and what risks arise if assumptions are wrong.

Companies that view compliance as a burden tend to be reactive and unprepared during inspections. Those that treat data protection as a control framework become more resilient, efficient, and trusted by the market.

Ultimately, personal data protection compliance is not just about avoiding sanctions, but about building a sustainable business in the data-based economy era.

FAQ: Differences between GDPR, CCPA, and the PDP Act