Which statement best describes the governance emphasis of GDPR compared to CCPA, and a common requirement they share?

• A. GDPR and CCPA both completely harmonize data protection laws with identical consent standards.
• B. GDPR governs only corporate data; CCPA governs personal data; they share no common governance requirements.
• C. GDPR covers EU residents' personal data with consent and subject rights; CCPA covers California consumers with access and deletion rights; both require governance around data protection, transparency, and security.
• D. GDPR applies to the US only, CCPA to the EU; both require annual reporting to regulators.

Answer: (C)

The main idea here is how two major privacy laws shape how organizations govern personal data and the common safeguards they expect. GDPR focuses on protecting the personal data of individuals in the EU, using consent as one lawful basis for processing and giving data subjects strong rights to access, correct, erase, restrict, move, or object to processing. CCPA, aimed at California residents, centers on rights to know what data is collected, to access it, to delete it, and to opt out of sales, with CPRA expanding protections even further. Despite these different focal points, both laws require strong governance around data protection, transparency, and security—things like clear privacy notices, data inventories, access controls, breach response, and procedures for handling requests from data subjects or consumers and for managing third-party processors. That’s why the best choice is the one that describes GDPR as covering EU residents’ personal data with consent and subject rights, CCPA as covering California consumers with access and deletion rights, and both requiring governance around data protection, transparency, and security.

The other options misstate scope or requirements. They either imply complete harmonization with identical consent standards, or claim radically different scopes and no shared governance needs, or assign the laws to the wrong regions, or suggest annual regulator reporting as a requirement.