GDPR vs PIPL: EU and China Data Privacy Laws Compared (2026)

The GDPR and China's PIPL share a similar structure but diverge on several operationally critical points: PIPL Article 13 omits legitimate interests as a lawful basis, requires separate consent for third-party sharing and cross-border transfers that rely on consent, mandates data localization for high-volume handlers, and imposes personal liability on responsible individuals.

The EU's General Data Protection Regulation (GDPR) and China's Personal Information Protection Law (PIPL), effective November 1, 2021, represent two fundamentally different philosophies of data protection. Both laws grant individuals rights over their personal information, but the PIPL reflects China's distinct emphasis on state authority and data sovereignty. For organizations operating across both jurisdictions, the differences in legal bases, consent requirements, cross-border transfer rules, and supervisory structure create material compliance complexity.

This article covers the two frameworks side by side, including 2025-2026 regulatory developments under both regimes.

Information last verified on 2026-10-26. This article has not yet been reviewed by a licensed lawyer.

Jurisdiction scope: This article addresses the EU General Data Protection Regulation (GDPR, applicable in all 30 EEA member states) and China's Personal Information Protection Law (PIPL, effective November 1, 2021), along with China's Cybersecurity Law (as amended, effective January 1, 2026) and Data Security Law (effective September 1, 2021). It does not address US state privacy laws (for those, see US data privacy laws) or other national privacy regimes. For the full PIPL context within China's broader legal framework, see our China data privacy laws guide.

GDPR vs PIPL: At a Glance

The table below captures the highest-leverage comparison points. Detailed analysis follows in each section.

Background and Legislative Context

The GDPR emerged from the European tradition of privacy as a fundamental right, codified in Article 8 of the EU Charter of Fundamental Rights. It replaced the 1995 Data Protection Directive and harmonized data protection across 30 EEA countries starting May 25, 2018.

China's PIPL is one pillar of a three-law stack that governs cybersecurity, data security, and personal information in China. The other two are the Cybersecurity Law (CSL) and the Data Security Law (DSL, effective September 1, 2021). Together, these three laws form a comprehensive framework for information flows in and out of China. The PIPL was adopted by the Standing Committee of the National People's Congress on August 20, 2021, and became effective November 1, 2021.

The PIPL shares structural similarities with the GDPR -- Chinese regulators studied the European model during drafting. However, the PIPL was also shaped by China's distinct policy objectives around data sovereignty, national security, and the regulation of large technology platforms. The result is a law that looks familiar in structure but diverges sharply on some of the most operationally important details.

Scope and Territorial Application

Both laws apply extraterritorially, but through different mechanisms.

The GDPR applies under Article 3 to organizations established in the EEA and to organizations outside the EEA that offer goods or services to individuals in the EEA or monitor their behavior. Non-EU organizations within scope must appoint an EU representative under Article 27.

The PIPL applies under Article 3 to all processing of personal information within China, and also applies outside China when the purpose is to provide products or services to individuals in China, to analyze or evaluate the behavior of individuals in China, or in other circumstances specified by law. Organizations outside China within scope must establish a dedicated entity or appoint a representative in China for personal information protection matters (PIPL Article 53).

The practical enforcement leverage differs. The EU relies on sanctions, processing bans, and -- for EU-to-third-country transfers -- the adequacy mechanism. China can restrict market access directly for non-compliant foreign organizations, giving the PIPL enforcement reach that the GDPR lacks.

Definitions and Protected Data

The PIPL defines personal information as any information related to an identified or identifiable natural person recorded by electronic or other means, excluding anonymized information. The GDPR's personal data definition is substantively equivalent.

The PIPL's sensitive personal information category (Art. 28) includes biometric data, religious beliefs, specific identity information, medical and health information, financial accounts, location tracking, and the personal information of minors under 14 years old. The GDPR's special categories (Art. 9) cover racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life, and sexual orientation data. The PIPL adds minors' data and financial account data to the sensitive category; the GDPR adds political opinions, trade union membership, and sexual orientation.

Legal Bases for Processing

The GDPR provides six lawful bases under Article 6: consent, contract performance, legal obligation, vital interests, public task, and legitimate interests.

The PIPL's Article 13 provides seven circumstances under which personal information handlers may process personal information. The critical omission is legitimate interests.

The absence of a legitimate interests basis in the PIPL is one of the most significant practical differences for multinational organizations. Under the GDPR, legitimate interests is the legal basis most commonly used for direct marketing, fraud prevention, network and information security, intra-group data sharing, and analytics. Under the PIPL, organizations must typically obtain consent for these activities or restructure them to fall under another enumerated basis.

Consent Requirements: Separate and Granular

The PIPL's consent requirements are more granular than the GDPR's. Both laws require consent to be freely given, specific, informed, and capable of withdrawal (the GDPR: as easy as giving it, Art. 7(3); the PIPL: a convenient withdrawal method, Art. 15).

The PIPL goes further by requiring separate consent (a higher standard than standard consent) in five specific situations:

• Providing personal information to third parties (Art. 23)
• Publicly disclosing personal information (Art. 25)
• Processing sensitive personal information (Art. 29)
• Transferring personal information outside China (Art. 39)
• Using images or personal identification collected by public surveillance equipment for non-public-safety purposes (Art. 26)

The GDPR requires explicit consent mainly for special categories of personal data (Article 9), and uses it as an option for automated decisions (Article 22(2)(c)) and as a derogation for international transfers (Article 49). The PIPL's separate consent requirements for third-party sharing and public disclosure go beyond what the GDPR demands. These separate-consent duties apply where the processing relies on consent: PIPL Article 13's second paragraph says consent required by other provisions is not needed where another Article 13 basis, such as contract necessity, applies.

Individual Rights: PIPL Articles 44-50 vs GDPR Chapter 3

Both laws grant individuals substantial rights over their personal information, with the PIPL largely tracking GDPR Chapter 3 in structure but differing on timelines and scope.

The rights under PIPL Articles 44-50 are:

• Right to know and decide (Art. 44): individuals may restrict or refuse processing of their personal information. This maps to the GDPR's right to object (Art. 21) and right to restrict processing (Art. 18).
• Right of access (Art. 45): individuals may access a copy of their personal information held by an organization. The GDPR equivalent is Article 15.
• Right to correction (Art. 46): individuals may request correction of inaccurate personal information. The GDPR equivalent is Article 16.
• Right to erasure (Art. 47): organizations must delete personal information where the processing purpose has been achieved, the retention period has expired, consent has been withdrawn, processing was unlawful, or other grounds apply. The GDPR equivalent is Article 17.
• Right to data portability (Art. 45): individuals may request transfer of personal information to another handler, but only where the conditions specified by the CAC are met. The GDPR's Article 20 portability right applies more broadly to consent-based and contract-based processing.
• Right regarding automated decisions (Art. 24): where automated decision-making has a significant effect on an individual's rights and interests, the individual may request explanation and may refuse to accept decisions made solely through automated means. The GDPR's Article 22 covers automated individual decision-making with a similar scope.
• Rights for deceased persons' family (Art. 49): family members of a deceased individual may exercise access, correction, and deletion rights in their legitimate interests. The GDPR has no equivalent provision.

The absence of a fixed response deadline in the PIPL creates enforcement asymmetry. Organizations in China cannot plan their request-response infrastructure around a specific statutory clock, and individuals exercising rights have less certainty about when to expect a response.

Supervisory Structure: EDPB/DPAs vs CAC and Multi-Regulator Model

The two frameworks use fundamentally different supervisory architectures.

Under the GDPR, each EU member state designates one or more national supervisory authorities (DPAs). These DPAs are required to be fully independent and exercise their powers impartially (Art. 52). For organizations operating across multiple EU member states, the one-stop-shop mechanism (Art. 56) allows the DPA of the member state where the organization's main establishment is located to act as lead supervisory authority for cross-border processing. The European Data Protection Board (EDPB) coordinates consistency across national DPAs, issues binding decisions in cross-border disputes, and publishes guidelines, recommendations, and opinions that shape how DPAs enforce the GDPR across the EEA.

China's PIPL uses a multi-regulator model set out in Article 60. No single authority has jurisdiction equivalent to a national DPA. The Cyberspace Administration of China (CAC) takes the lead and coordinating role. Other regulators exercise authority within their designated sectors:

• MIIT (Ministry of Industry and Information Technology): apps, telecommunications, internet services, software
• Ministry of Public Security: security-related personal information processing, surveillance, facial recognition
• SAMR (State Administration for Market Regulation): consumer-facing products and services, e-commerce
• Financial sector regulators (People's Bank of China, National Financial Regulatory Administration, CSRC): financial data processed by institutions under their supervision
• Health regulators: health and medical data
• Local counterparts of each ministry: enforcement at the provincial and municipal level

In 2025, the CAC led multi-departmental enforcement actions alongside MIIT and public security agencies, targeting six high-incidence areas: apps and mini-programs, software development kits (SDKs), smart terminals, facial recognition in public places, offline consumer scenarios, and data-related criminal activity.

For organizations subject to both frameworks, the practical difference is significant. Under the GDPR, a company can identify its lead DPA based on its main EU establishment and engage primarily with that authority. Under the PIPL, responsibility is distributed across sector regulators, and multiple agencies may have concurrent jurisdiction over a single organization's activities.

Government Access to Personal Data

This is the area of greatest philosophical divergence between the two frameworks.

The GDPR limits government access to personal data through the principles of necessity and proportionality (Art. 23). EU law requires government surveillance to be subject to judicial or independent oversight. The Court of Justice of the EU (CJEU) has struck down international transfer mechanisms on the grounds that foreign government access was insufficiently limited, including the US-EU Privacy Shield in 2020 (Schrems II).

China's framework requires broad cooperation with government authorities. The National Intelligence Law (2017) Article 7 requires all organizations and citizens to "support, assist, and cooperate with national intelligence work." PIPL Article 35 provides that government agencies processing personal information for statutory duties must comply with the PIPL's requirements, but the National Intelligence Law, the Data Security Law (which governs "important data" in the national interest), and the amended CSL together create broad state-access obligations.

The EDPB has identified government access regimes in third countries as a factor that organizations must weigh in transfer impact assessments. The European Commission has not adopted an adequacy decision for China (checked October 2026), so transfers from the EU to China need another Chapter V mechanism.

Cross-Border Data Transfers

Cross-border transfer rules represent one of the starkest operational differences between the two frameworks.

The GDPR allows transfers through: adequacy decisions (Art. 45), Standard Contractual Clauses (SCCs, Art. 46), Binding Corporate Rules (BCRs, Art. 47), codes of conduct and certification (Art. 40-42), or derogations for specific situations (Art. 49). Organizations have multiple pathways. Adequacy and the Commission's standard contractual clauses need no regulator filing, while binding corporate rules and ad hoc contractual clauses need supervisory-authority approval (Arts. 46(3), 47).

The PIPL's Article 38 establishes three transfer mechanisms with mandatory government involvement in two of the three:

Under the CAC's Provisions on Promoting and Regulating Cross-Border Data Flows (Order No. 16, 2024), a security assessment is required for any transfer of important data, for Critical Information Infrastructure Operators (CIIOs) transferring personal information outside the contract-necessity, HR-management and emergency exemptions, and for non-CIIOs that since 1 January of the year have transferred abroad personal information of 1 million or more individuals (excluding sensitive data) or sensitive personal information of 10,000 or more. Non-CIIOs transferring 100,000 to under 1 million individuals' non-sensitive data, or under 10,000 individuals' sensitive data, use the standard contract (filed with the provincial CAC) or certification. Non-CIIO transfers below 100,000 individuals' non-sensitive data, and transfers that fit the contract-necessity, HR-management or emergency exemptions, need none of the three.

The certification route was formalized when the CAC and SAMR jointly issued the Measures for Certification of Outbound Personal Information Transfers (Order No. 20), issued October 14, 2025 and effective January 1, 2026. Certification is carried out by professional certification bodies holding a SAMR-approved qualification, which must file with the CAC within 10 working days of that approval. This completed the three-track transfer framework that the PIPL had contemplated since its enactment.

Whichever mechanism is used, PIPL Article 39 requires the organization to tell individuals who the overseas recipient is, how it will process their data and how to exercise their rights against it. Where the transfer relies on consent, it also needs the individual's separate consent; where another basis such as contract necessity or HR management applies, consent is not required (PIPL Art. 13, second paragraph). The GDPR requires transfer information in privacy notices (Art. 13(1)(f)) but uses consent for transfers only as a derogation (Art. 49).

Data Localization

The PIPL, in conjunction with the CSL and DSL, imposes data localization requirements that have no GDPR parallel.

CIIOs must store personal information collected and generated within China domestically (PIPL Art. 40; CSL Art. 39). Handlers whose processing reaches a volume set by the CAC must also store that data locally (PIPL Art. 40); whether a transfer abroad then needs a CAC security assessment is decided by the Order 16 thresholds and exemptions described above. The amended CSL (effective January 1, 2026) renumbered the CIIO localization rule as Article 39, and violations are now penalized under other applicable laws, such as the PIPL and DSL (new Article 71).

The GDPR contains no data localization requirement. Data flows freely within the EEA, and cross-border transfers outside the EEA are permitted through the mechanisms described above. There is no requirement to maintain a copy of personal data within EU territory.

This divergence creates a structural compliance problem for organizations that operate integrated EU-China data systems. Maintaining separate data silos for Chinese and European operations is the most common solution -- but it entails ongoing infrastructure cost and limits the operational benefits of data centralization.

Enforcement and Penalties

Both frameworks carry significant penalties, but the PIPL's personal liability provisions make it uniquely severe for individual officers.

Total GDPR fines since May 2018 reached about EUR 5.88 billion by January 2025, according to DLA Piper's January 2025 survey. Notable 2024 enforcement actions include LinkedIn Ireland (EUR 310 million, Irish DPC, behavioral advertising), Uber (EUR 290 million, Dutch DPA, inadequate EU-US transfer safeguards), and Meta (EUR 251 million, Irish DPC, 2018 data breach). The Irish DPC has issued over EUR 3.5 billion in fines since 2018, principally against large US technology companies with EU main establishments in Ireland. Our guide explains how to make a GDPR complaint to Ireland's Data Protection Commission.

In 2024 the national CAC system, enforcing all of China's internet laws (mostly content rules, not only the PIPL), summoned 11,159 platforms, warned or fined 4,046, and worked with telecom regulators to close 10,946 websites. In a 2025 case published by the Ministry of Public Security, Shanghai police penalized the China company of an overseas fashion brand for transferring user personal information to its overseas headquarters without a security assessment, standard contract or certification, without adequately informing users and without obtaining separate consent.

The Wider Chinese Data-Law Stack: CSL, DSL, and PIPL

Organizations doing business in China face three interlocking statutes that interact with the PIPL.

Cybersecurity Law (CSL, amended effective January 1, 2026). Originally enacted in 2017, the CSL governs network operators and Critical Information Infrastructure Operators. The Standing Committee of the National People's Congress passed amendments on October 28, 2025, and the revised CSL took effect January 1, 2026. Key changes in the amended CSL include:

• Tiered penalty structure: fines up to RMB 10 million for businesses and RMB 1 million for individuals for particularly serious violations (versus lower prior caps)
• A new AI policy article: Article 20 commits the state to supporting AI research and infrastructure such as training data and computing power, improving AI ethics norms, and strengthening AI risk monitoring, assessment and safety supervision. It is a policy provision, not a new compliance duty for operators
• Expanded extraterritorial scope: the amended law covers any foreign organization or individual whose activities "endanger the cybersecurity of China" -- broader than the prior law's focus on activities harming critical information infrastructure
• Supply chain: the fine of 1-10 times the procurement value for CIIOs that use network products or services that have not passed security review carried over (now Article 67), and a new Article 63 penalizes selling or providing critical network equipment and specialized security products that lack the required certification or testing
• Mitigating circumstances: new Article 73 allows reduced penalties for violations promptly corrected, proactively disclosed, or of minor consequence with full cooperation

Data Security Law (DSL, effective September 1, 2021). The DSL governs data other than personal information -- specifically "important data" and "core data" in the national interest. It requires organizations to classify data by importance level, implement security measures proportionate to the classification, and obtain government approval before transferring important or core data abroad. The DSL applies to data processing activities in China and, under Article 2, to activities outside China that harm China's national security, public interests, or citizens' or organizations' lawful rights and interests.

PIPL. Governs personal information specifically, sitting on top of the DSL's data security requirements. A single piece of data (e.g., a database of Chinese consumers) can trigger obligations under all three laws simultaneously.

For organizations outside China, the amended CSL's expanded extraterritorial scope means that cybersecurity-related activities affecting Chinese networks -- not only personal information processing -- can now directly expose foreign organizations to Chinese regulatory jurisdiction.

Recent Developments (2025-2026)

PIPL Compliance Audit Management Measures (effective May 1, 2025). The CAC issued these measures on February 12, 2025 and published them on February 14, 2025. Organizations processing personal information of more than 10 million individuals must conduct self-initiated compliance audits at least every two years. Regulators may also order mandatory audits for any organization when processing activities involve significant risk, widespread impact on individual rights, or a security incident involving the personal information of 1 million or more individuals, or the sensitive personal information of 100,000 or more. Audit elements include: lawful bases, notice and consent, cross-border transfer compliance, automated decision-making, sensitive data handling, retention and deletion, data subject request procedures, and incident response. The same audit firm (or its affiliates) or lead auditor may not audit the same organization three or more times in a row.

Cross-Border Certification Measures (effective January 1, 2026). On October 14, 2025 the CAC and SAMR jointly issued the Measures for Certification of Outbound Personal Information Transfers (Order No. 20), completing the three-track transfer framework contemplated by PIPL Article 38. The certification route is available to non-CIIO organizations that since 1 January of the year have transferred abroad non-sensitive personal information of 100,000 to under 1 million individuals, or sensitive personal information of under 10,000 individuals. Certification bodies must file with the CAC within 10 working days of obtaining their SAMR qualification.

Amended Cybersecurity Law (effective January 1, 2026). As described above, the amended CSL introduced tiered penalties, an AI policy article, expanded extraterritorial scope, and a new penalty for selling uncertified critical network equipment. For organizations already subject to the PIPL, the amended CSL adds an additional compliance layer for network and cybersecurity obligations.

GDPR enforcement trajectory (2024-2027). GDPR fines totalled about EUR 1.2 billion in 2024, down from 2023 because the record EUR 1.2 billion Meta fine fell in 2023 (DLA Piper, January 2025). The EDPB settles disputes between supervisory authorities through binding decisions (Art. 65), and the GDPR also has an urgency procedure (Art. 66). Regulation (EU) 2025/2518, which adds procedural rules for cross-border GDPR enforcement cases, applies from 2 April 2027.

Dual-Compliance Guidance

Organizations subject to both the GDPR and PIPL face conflicts in several key areas. The following checklist maps the divergences most likely to require structural compliance choices.

Many multinational organizations address GDPR-PIPL conflicts by operating separate data processing environments for Chinese and European operations, minimizing the need for cross-border transfers between the two jurisdictions, and maintaining independent consent records for each regime.

For more detail on the GDPR framework, see our complete EU data privacy laws guide. For China's full privacy framework, see our China data privacy laws guide.

Disclaimer

This article presents general legal information about the EU General Data Protection Regulation and China's Personal Information Protection Law. It does not constitute legal advice. The information reflects the laws as of October 26, 2026. Both frameworks continue to evolve through implementing regulations, regulatory guidance, and enforcement actions. Organizations subject to the GDPR or PIPL should consult a lawyer licensed in the relevant jurisdiction for advice specific to their situation.

Authorities Cited

Chinese law and authorities

1. Personal Information Protection Law of the People's Republic of China (PIPL), adopted August 20, 2021, effective November 1, 2021 (CAC official text). https://www.cac.gov.cn/2021-08/20/c_1631050028355286.htm
2. Regulation (EU) 2016/679 (General Data Protection Regulation), Art. 3, 6, 7, 8, 9, 12-22, 27, 33-34, 37-39, 45-49, 52, 56, 65-66, 83-84. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679
3. NPC Standing Committee Decision amending the Cybersecurity Law (adopted October 28, 2025, effective January 1, 2026). http://www.npc.gov.cn/npc/c2/c30834/202510/t20251028_449048.html
4. Data Security Law of the People's Republic of China (DSL), effective September 1, 2021. http://www.npc.gov.cn/npc/c2/c30834/202106/t20210610_311888.html
5. National Intelligence Law of the People's Republic of China (2017), Art. 7. http://www.npc.gov.cn/zgrdw/npc/xinwen/2017-06/27/content_2024529.htm
6. CAC Order No. 16, Provisions on Promoting and Regulating Cross-Border Data Flows (March 22, 2024). https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm
7. CAC and SAMR Order No. 20, Measures for Certification of Outbound Personal Information Transfers (issued October 14, 2025, effective January 1, 2026). https://www.gov.cn/zhengce/zhengceku/202510/content_7044914.htm
8. CAC, Administrative Measures for Personal Information Protection Compliance Audits (issued February 12, 2025, effective May 1, 2025). https://www.cac.gov.cn/2025-02/14/c_1741233507681519.htm
9. CAC, 2024 national enforcement summary (February 25, 2025). https://www.cac.gov.cn/2025-02/25/c_1742186054989836.htm
10. Ministry of Public Security, typical administrative enforcement cases (2025). https://m.mps.gov.cn/n6935718/n6936559/c10237071/content.html
11. State Council, institutional reform plan establishing the National Financial Regulatory Administration (March 2023). https://www.gov.cn/zhengce/2023-03/16/content_5747072.htm

EU law and authorities

12. Regulation (EU) 2025/2518 (additional procedural rules for GDPR enforcement), applies from 2 April 2027. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32025R2518
13. European Data Protection Board (EDPB). Guidelines, recommendations, and opinions. https://edpb.europa.eu/edpb_en
14. European Commission. Adequacy Decisions. https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
15. Irish Data Protection Commission, LinkedIn Ireland decision (October 24, 2024). https://www.dataprotection.ie/en/news-media/press-releases/irish-data-protection-commission-fines-linkedin-ireland-eu310-million
16. Irish Data Protection Commission, Meta decisions (December 17, 2024). https://www.dataprotection.ie/en/news-media/press-releases/irish-data-protection-commission-fines-meta-eu251-million
17. Dutch Data Protection Authority, Uber decision (2024). https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-of-290-million-euro-on-uber-because-of-transfers-of-drivers-data-to-the-us

Secondary sources

18. IAPP. Analyzing China's PIPL and How It Compares to the EU's GDPR. https://iapp.org/news/a/analyzing-chinas-pipl-and-how-it-compares-to-the-eus-gdpr
19. DLA Piper GDPR Fines and Data Breach Survey: January 2025. https://www.dlapiper.com/en-us/insights/publications/2025/01/dla-piper-gdpr-fines-and-data-breach-survey-january-2025

---

Last updated: 2026-10-26. Laws cited reflect their in-force versions as of 2026-10-26.

Frequently Asked Questions

Is the PIPL stricter than the GDPR?

In several areas, yes. The PIPL imposes higher maximum fines (5% of revenue vs. 4%), personal liability on responsible individuals (up to RMB 1 million plus career prohibitions), mandatory data localization for CIIOs and high-volume handlers, government security assessments for cross-border transfers, and separate consent requirements for third-party sharing and public disclosure. The GDPR is stricter in other respects: it provides more detailed DPO independence requirements, requires responses to rights requests within a fixed one-month deadline (vs. PIPL's 'timely' standard), and limits government access to personal data through stronger judicial oversight requirements.

Does the PIPL apply to companies outside China?

Yes. PIPL Article 3 applies extraterritorially to organizations outside China that process personal information to provide products or services to individuals in China, or to analyze and evaluate the behavior of individuals in China. Such organizations must establish a dedicated entity or appoint a representative in China under Article 53.

What are the three cross-border transfer routes under China's PIPL?

The PIPL's Article 38 provides three routes: (1) a CAC security assessment, required for any transfer of important data, for Critical Information Infrastructure Operators outside the contract-necessity, HR and emergency exemptions, and for non-CIIOs that since 1 January of the year have transferred abroad personal information of 1 million or more individuals or sensitive personal information of 10,000 or more; (2) a standard contract filed with the provincial CAC; and (3) certification by a professional certification body approved by SAMR and filed with the CAC, available since January 1, 2026. Routes (2) and (3) cover non-CIIOs transferring 100,000 to under 1 million individuals' non-sensitive data or under 10,000 individuals' sensitive data; smaller non-CIIO transfers and contract, HR and emergency transfers need none of them (CAC Order 16). Individuals must always be told about the overseas recipient, and separate consent is needed where the transfer relies on consent (Arts. 13, 39).

Why does the PIPL not include legitimate interests as a legal basis?

The PIPL's omission of legitimate interests reflects a policy choice to limit organizational discretion in determining when processing is lawful without consent. Under the GDPR, legitimate interests allows organizations to process data based on their own balancing assessment of their interests against individuals' rights. China's approach, reflected in PIPL Article 13, requires processing to fall within one of seven enumerated bases, giving regulators more predictable authority over what processing is permissible. Organizations that use legitimate interests under GDPR for marketing, analytics, or fraud prevention must obtain consent or find another Article 13 basis for the same activities in China.

Does China have an EU adequacy decision?

No. The European Commission has not adopted an adequacy decision for China (checked October 2026). Any adequacy assessment would have to weigh China's government access regime, such as the National Intelligence Law's Article 7 requirement for organizations to cooperate with intelligence work, against the GDPR's 'essentially equivalent' standard. Transfers from the EU to China must use Standard Contractual Clauses or another Article 46 mechanism, supplemented by a transfer impact assessment.

What is the PIPL Compliance Audit Measures requirement?

The CAC's Administrative Measures for Personal Information Protection Compliance Audits, effective May 1, 2025, require organizations processing the personal information of more than 10 million individuals in China to conduct self-initiated compliance audits at least every two years. Audits must cover lawful processing bases, consent procedures, cross-border transfer compliance, automated decision-making, sensitive data handling, retention and deletion, data subject request processing, and incident response. Regulators may also order mandatory audits for any organization found to have significant risks or following a security incident involving the personal information of 1 million or more individuals (or sensitive personal information of 100,000 or more). The same audit firm or lead auditor may not audit the same organization three or more times in a row.

What changed with China's Cybersecurity Law in 2026?

The Standing Committee of the National People's Congress passed amendments to the Cybersecurity Law on October 28, 2025, effective January 1, 2026. Key changes include: tiered penalties (up to RMB 10 million for businesses and RMB 1 million for individuals for particularly serious violations); a new AI policy article (state support for AI development, improved AI ethics norms and stronger AI risk monitoring and supervision); expanded extraterritorial scope (now covering any foreign organization whose activities endanger China's network security, not only critical infrastructure-related activities); a new penalty for selling uncertified critical network equipment; and new mitigating circumstances for prompt correction. The amended CSL integrates with the DSL and PIPL as part of China's three-law data governance framework.

What individual rights does the PIPL grant compared to the GDPR?

The PIPL's Articles 44-50 grant rights broadly parallel to GDPR Chapter 3: right to know and decide (similar to GDPR's right to object and restrict), right of access, right to correction, right to erasure, right to data portability (with CAC conditions), and the right to explanation of automated decisions. One unique PIPL provision is Article 49, which allows family members of a deceased individual to exercise access, correction, and deletion rights in their legitimate interests -- the GDPR has no equivalent. A key difference is response timelines: the GDPR requires responses within one month (Art. 12); the PIPL requires only 'timely' response without a fixed statutory deadline.

How does China's multi-regulator model differ from the EU's DPA system?

Under the GDPR, each EU member state has one or more independent DPAs, coordinated by the European Data Protection Board (EDPB) through the one-stop-shop mechanism. A company with its main EU establishment in Ireland deals primarily with the Irish DPC for cross-border cases. China's PIPL uses a multi-regulator model under Article 60: the CAC takes the lead role, but the MIIT, Ministry of Public Security, SAMR, and financial sector regulators each enforce PIPL within their sectors. Local counterparts also have enforcement authority. Multiple agencies may have concurrent jurisdiction over a single organization's activities, with no one-stop-shop equivalent.

What is 'separate consent' under China's PIPL?

The PIPL requires 'separate consent' for five specific activities: providing personal information to third parties (Art. 23), publicly disclosing personal information (Art. 25), processing sensitive personal information (Art. 29), transferring personal information outside China (Art. 39), and using images collected by public surveillance equipment for non-safety purposes (Art. 26). Separate consent is a higher standard than standard consent -- it cannot be bundled with general terms and conditions or consent for other processing activities. Where the processing relies on consent, an organization must obtain a distinct, specific consent for each of these activities, even if the individual has already provided general consent to the organization's processing; where another Article 13 basis such as contract necessity applies, consent is not required (Art. 13, second paragraph).