Privacy Law Quick-Diff

anchor@anchor-cyber:~$ diff hipaa.law ccpa.law gdpr.law

Accurate as of September 2026 — not legal advice Deadlines and thresholds reflect the law as of this card's publication date; they are not automatically updated when a statute or regulation changes. This is general information, not legal advice, and applicability thresholds especially have exceptions this card doesn't capture — confirm current requirements with counsel before relying on a number here for a specific client situation.

Applies To

	HIPAA	CCPA / CPRA	GDPR
Scope	Covered entities & business associates handling PHI	For-profit businesses meeting revenue/data-volume thresholds, doing business in California	Any org processing EU/EEA residents' personal data, regardless of where the org is based
Protected data	Protected Health Information (PHI)	"Personal information" — broad, includes inferences	"Personal data" — broad, includes online identifiers

$ diff --breach-notification

Breach Notification

	HIPAA	CCPA / CPRA	GDPR
Regulator	HHS: ≤60 days from discovery if ≥500 affected; within 60 days of year-end if <500	Not a CCPA-specific deadline — CA's general breach law (Civ. Code §1798.82) requires "the most expedient time possible, without unreasonable delay"	Supervisory authority: 72 hours from awareness, if risk to rights/freedoms
Affected people	≤60 days from discovery, without unreasonable delay	Same "most expedient time" standard as above — commonly treated as 30–45 days in practice	Without undue delay, only when the breach is high-risk to the individual

$ diff --rights-requests

Individual Rights Request Response Time

	HIPAA	CCPA / CPRA	GDPR
Deadline	30 days for a records access request (§164.524) — not the same clock as breach notification	45 days, extendable once by another 45 (90 max) with notice to the consumer; acknowledge receipt within 10 business days	1 month, extendable by 2 further months for complex requests, with notice