Any company that processes personal data can be subject to comply with the GDPR and CCPA. As an agency, you should evaluate what data you use and how, especially any data processed on behalf of or from your clients. If you process any data on behalf of your clients, you may be considered a “data processor” and therefore subject to additional rules regarding that data.