GDPR and CCPA for U.S. Broker-Dealers: When Each Applies

Updated October 2026. First published May 2024.

Our 2024 post treated the GDPR and the California Consumer Privacy Act (CCPA) as if they applied to every financial firm in the same way. For a U.S. broker-dealer, they don't. Most of the customer data a broker-dealer holds falls under the Gramm-Leach-Bliley Act (GLBA), which the SEC applies to broker-dealers through Regulation S-P. The CCPA exempts that data, with one important exception. The GDPR reaches a U.S. firm only in specific circumstances. And the data the CCPA does reach is often data firms don't think of as privacy data at all: employees, job applicants, and the business contacts at institutional clients and counterparties.

The CCPA: Is Your Firm a "Business"?

The CCPA applies to a for-profit company that does business in California, collects consumers' personal information, and meets at least one of three thresholds in Civil Code Section 1798.140(d):

• Annual gross revenue above $25 million in the preceding calendar year, adjusted for inflation. The California Privacy Protection Agency (CPPA) raised the figure to $26,625,000 as of January 1, 2025, and the next adjustment is due January 1, 2027.
• Buying, selling, or sharing the personal information of 100,000 or more consumers or households a year.
• Earning 50 percent or more of annual revenue from selling or sharing consumers' personal information.

"Consumer" in the CCPA means any natural person who is a California resident, whether or not that person is your customer. A broker-dealer under the revenue threshold that doesn't buy, sell, or share personal information at that scale is outside the CCPA entirely.

The GLBA Exemption Covers Data, Not Firms

Section 1798.145(e) says the CCPA "shall not apply to personal information collected, processed, sold, or disclosed subject to" the GLBA and its implementing regulations. That is an exemption for a category of data. A broker-dealer that meets a threshold is still a CCPA business, and only its GLBA data is carved out.

Regulation S-P defines that data. A "consumer" under Regulation S-P is an individual who obtains a financial product or service for personal, family, or household purposes, including someone who applies but never opens an account. Someone who only gives you a name and address to request a prospectus isn't one. So the exemption covers retail customers and applicants, and it leaves out:

• Employees and job applicants. The CCPA's temporary exemption for them expired on January 1, 2023.
• Business contacts: the operations, trading, and compliance staff at institutional clients, counterparties, and vendors whose names and emails sit in your systems. That exemption also expired on January 1, 2023.
• Website visitors, event attendees, and marketing lists of people who haven't applied for anything.

The exception inside the exemption is Section 1798.150, the CCPA's private right of action for data breaches. The GLBA carve-out "shall not apply to Section 1798.150." If nonencrypted, nonredacted personal information is stolen or disclosed because the firm didn't maintain reasonable security, California consumers can sue for statutory damages of $107 to $799 per consumer per incident, or actual damages if greater, at the 2025 adjusted amounts. That is a reason to treat the security of GLBA data in California as a CCPA issue too.

The CPPA's newer regulations raise the stakes for whatever data isn't exempt. They took effect January 1, 2026 and add cybersecurity audits, risk assessments, and rules for automated decisionmaking technology for businesses whose processing meets their criteria. The first cybersecurity audit certifications are due April 1, 2028, from businesses with more than $100 million in revenue, then April 1, 2029, for those between $50 million and $100 million, and April 1, 2030, for the rest.

The GDPR: When It Reaches a U.S. Firm

A U.S. broker-dealer with no office in the EU can fall under the GDPR only through Article 3(2), which covers processing related to "the offering of goods or services" to people in the EU, or "the monitoring of their behaviour as far as their behaviour takes place within the Union."

Recital 23 explains how to tell whether a firm is offering services there. The "mere accessibility" of your website from the EU isn't enough, and neither is an email address. What counts is evidence that you intend to serve people there: a language or currency used in a member state, or references to customers in the EU. A U.S. firm that opens accounts for EU residents it went looking for is in scope. A firm whose website happens to be readable in Paris isn't.

If you are in scope, Article 27 requires you to name a representative in the EU, unless your processing is occasional, excludes large-scale processing of special categories of data, and is unlikely to put people at risk. Fines for the most serious violations can reach €20 million or 4 percent of worldwide annual turnover, whichever is higher. There's no GLBA-style carve-out in the GDPR.

Where Each Law Lands

Regulation S-P Is Where Most of the Work Is

For most broker-dealers, the obligations with the most behind them are in the amended Regulation S-P: a written incident response program, notice to affected customers no later than 30 days after you become aware of unauthorized access to their sensitive information, and procedures that make service providers notify you within 72 hours. Larger firms had to comply by December 3, 2025, and smaller firms by June 3, 2026. Our post on settlement instruction fraud and Regulation S-P covers the amendments.

A sensible order of work: Regulation S-P first, because it covers your customers and its compliance dates have passed. Then the CCPA, if you meet a threshold. Start with HR and business-contact data. Then the GDPR, only if you serve people in the EU on purpose.

This post is for informational purposes only and does not constitute legal advice. For guidance on specific regulatory obligations, consult your counsel or compliance advisor.