(1) Operate business online or offline in the state of California AND
(2) Do at least one of the following:
Generate a gross revenue of more than $25 million a year
Receive or share personal information of more than 50,000 California residents
Earn at least half of their annual revenue by selling the personal information of California residents
If your organization meets the criteria above and collects, processes, and/or retains personal information for any California resident—no matter where they are in the country—your organization is subject to the CCPA.
Similarly, if your organization collects, processes, and/or retains information for any individual within the European Economic Area, GDPR addresses the use, protection, and international transfer of personal data.
In order to comply with changing perosnal data regulations, companies need to know what data they have, where it is located and why they have it.
Note: even if you’re not based in California, your firm may be affected if you have customers or employees based there.