A GDPR programme does not make an organisation PIPL compliant, because the two laws split on the very first question a privacy team asks: what lets us process this data at all. China's Personal Information Protection Law (PIPL) borrows much of the GDPR's vocabulary, from data subject rights to impact assessments, yet it has no legitimate interests basis, leans on separate consent in places the GDPR never does, and treats data leaving China as a regulated export with volume thresholds and filings. This guide is for privacy, security and GRC leads who run, or are about to run, one programme across the EU and mainland China and need to know which artefacts can be shared and which must be built twice. For the PIPL on its own read the China PIPL Guide, and for the export mechanics the China Cross-Border Data Transfers guide.
Status checked on 14 November 2026 against EUR-Lex (Regulation (EU) 2016/679), the Cyberspace Administration of China (CAC), the State Council and an English translation of the PIPL published by Stanford DigiChina.
Key takeaways
- No legitimate interests in China: PIPL Art. 13 lists seven grounds and none of them matches GDPR Art. 6(1)(f), so every processing activity that relies on legitimate interests in Europe needs a different basis, usually consent or contract necessity, in China.
- Separate consent is a distinct control: sharing with another handler, public disclosure, sensitive personal information and export abroad each need their own separate consent under PIPL Arts. 23, 25, 29 and 39, which a bundled GDPR consent screen does not satisfy.
- Exports are regulated by volume: under the CAC's March 2024 Provisions, the number of people whose data leaves China since 1 January decides whether a transfer is exempt, needs a standard contract or certification, or needs a CAC security assessment.
- Two transfer directions, two rulebooks: the EU has no adequacy decision for China, so EU to China flows need GDPR Chapter V safeguards such as SCCs, while China to EU flows need a PIPL route; one contract cannot serve both.
- The incident clocks differ in kind: GDPR Art. 33 sets 72 hours to the supervisory authority, PIPL Art. 57 says "immediately" with no hour count, and China's separate cybersecurity incident reporting measures add a 1, 2 or 4 hour report for network operators.
Short answer: what carries over and what does not
Use the GDPR programme as the governance backbone (records, assessments, rights handling, security controls, vendor terms) and add a China layer for five things: a legal basis map without legitimate interests, separate consent flows, export routing by volume, a Chinese-language incident path, and the PIPL roles (personal information protection officer and, for overseas handlers, a representative in China).
| GDPR artefact | Reuse for PIPL? | What to change |
|---|---|---|
| Art. 30 record of processing | Reuse with edits | Add the PIPL Art. 13 ground per row, a separate consent flag, the China export route and the cumulative export count since 1 January |
| Art. 35 DPIA | Adapt | PIPL Art. 55 requires a personal information protection impact assessment (PIPIA) for every export, every sharing or entrusting and all sensitive data, not only high-risk processing; Art. 56 requires keeping reports for at least three years |
| Art. 32 security programme | Reuse | PIPL Art. 51 lists internal rules, classification, encryption and de-identification, access limits, training and incident plans; the same control set evidences both |
| Legitimate interests assessments | Not reusable | Rebuild each activity on consent, contract or HR necessity, legal duty or another Art. 13 ground |
| Consent records | Adapt | Store separate consent events per purpose (sharing, disclosure, sensitive data, export) with the notice version shown |
| SCCs and transfer impact assessments | EU side only | For data leaving China use the CAC standard contract (filed within 10 working days), certification or a security assessment, plus a PIPIA |
| Art. 33 and 34 breach runbook | Adapt | Add the PIPL Art. 57 notice content, the CAC hotline channels and the 4 hour report for ordinary network operators |
| Art. 27 EU representative | Mirror | Overseas handlers caught by PIPL Art. 3(2) appoint a dedicated entity or representative in China under Art. 53 |
Side-by-side comparison
| Topic | GDPR (Regulation (EU) 2016/679) | PIPL (in force 1 November 2021) |
|---|---|---|
| Territorial reach | Art. 3: EU establishment, or offering goods or services to, or monitoring, people in the Union | Art. 3: handling in China, or abroad where the purpose is providing products or services to people in China or analysing or assessing their behaviour |
| Legal bases | Six (Art. 6(1)), including legitimate interests | Seven (Art. 13), no legitimate interests; consent not needed for grounds 2 to 7 |
| Consent | Freely given, specific, informed, unambiguous; Art. 7 withdrawal as easy as giving | Full knowledge, voluntary and explicit (Art. 14); renewed when purpose, method or categories change; separate consent for listed cases |
| Sensitive data | Art. 9 special categories, prohibited unless an Art. 9(2) condition applies | Art. 28 sensitive personal information, including financial accounts, location tracks and data of minors under 14; separate consent (Art. 29) |
| Impact assessment | DPIA where high risk is likely (Art. 35) | PIPIA before sensitive data, automated decisions, sharing or entrusting, disclosure and export (Art. 55) |
| Officer | DPO in the Art. 37(1) cases | Personal information protection officer where CAC volume thresholds are met (Art. 52) |
| Transfers out | Chapter V: adequacy, Art. 46 safeguards, Art. 47 BCRs, Art. 49 derogations | Art. 38: security assessment, certification, standard contract, or other CAC conditions, plus separate consent and a PIPIA |
| Localisation | None in the GDPR itself | Art. 40: critical information infrastructure (CII) operators and handlers above CAC volume thresholds store data in China |
| Breach notice | 72 hours to the authority where feasible (Art. 33); data subjects where high risk (Art. 34) | Immediately to regulators and individuals (Art. 57), individual notice may be waived if harm is effectively prevented |
| Maximum fine | EUR 20 million or 4% of worldwide annual turnover, whichever is higher (Art. 83(5)) | RMB 50 million or 5% of prior-year revenue for serious violations (Art. 66), plus fines of RMB 100,000 to 1 million and role bans for responsible individuals |
Legal bases: replacing legitimate interests
PIPL Art. 13 allows handling where the individual consents, where it is necessary to conclude or perform a contract with the individual or for human resources management under lawful labour rules and collective contracts, to meet statutory duties, for public health emergencies or to protect life, health or property, for news reporting and public-interest oversight within reasonable limits, for information the individual has made public or that was lawfully disclosed, and for other cases set by law. The GDPR's sixth basis, legitimate interests, has no counterpart.
In practice the activities that break are the ones European teams treat as routine:
- Security monitoring of staff: often legitimate interests under the GDPR. In China, anchor it to the HR management limb of Art. 13(2) through written internal rules, and keep it proportionate.
- Fraud and abuse analytics on customers: look for contract necessity or a statutory duty first; where neither fits, consent is the fallback, with a PIPIA if the analysis is automated decision-making (Art. 55).
- Direct marketing and product analytics: generally consent in China. Art. 14 requires consent again if the purpose or method changes, so version your notices.
- Group-wide data sharing: under the GDPR, intra-group controller sharing can rest on legitimate interests. Under PIPL Art. 23 providing data to another handler needs notice of the recipient and separate consent, unless another Art. 13 ground applies.
The record of processing therefore needs a basis column per law. Where the only honest China answer is consent, the product must work, or degrade gracefully, when consent is refused.
Separate consent and sensitive data
Separate consent is a consent given for one specific act and not bundled with acceptance of terms or a general privacy notice. The PIPL requires it in at least five places: providing data to another handler (Art. 23), public disclosure (Art. 25), using public-space image capture for anything beyond public security (Art. 26), sensitive personal information (Art. 29, written consent where other laws require it) and export abroad (Art. 39). The GDPR has no equivalent single concept; its closest relative is explicit consent under Art. 9(2)(a) and Art. 49(1)(a).
| Trigger | PIPL requirement | Nearest GDPR position | Build |
|---|---|---|---|
| Sharing with another handler | Notice of recipient, purpose, method, categories plus separate consent (Art. 23) | Any Art. 6 basis, transparency under Arts. 13 and 14 | Recipient-specific consent screen and register |
| Sensitive personal information | Separate consent; necessity and strict protection (Arts. 28 and 29) | Art. 9(2) condition, often explicit consent | Data classification that tags financial accounts and location tracks, which the GDPR does not treat as special category |
| Export abroad | Notice of overseas recipient and separate consent (Art. 39) | Not consent-based unless relying on an Art. 49(1)(a) derogation | Export consent captured before the transfer, linked to the transfer record |
Common trap: the CAC Provisions exempt some exports from the standard contract and assessment routes, but Art. 10 of those Provisions keeps the notice, separate consent and PIPIA duties in place. Exempt from filing is not exempt from consent.
Cross-border transfers: two directions, two rulebooks
EU to China (GDPR Chapter V)
China is not on the European Commission's list of adequacy decisions, so transfers from the EU need an Art. 46 safeguard (most often the Commission's 2021 standard contractual clauses under Implementing Decision (EU) 2021/914, or Art. 47 binding corporate rules) or, for occasional cases, an Art. 49 derogation. Art. 48 adds that a third-country court or administrative order to disclose personal data is only recognised where it rests on an international agreement such as a mutual legal assistance treaty. PIPL Art. 41 mirrors this from the other side: foreign judicial and law enforcement requests for data stored in China go through Chinese authorities. A transfer impact assessment for China should address both provisions.
China to the EU (PIPL Art. 38 and the 2024 Provisions)
The CAC's Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Order No. 16, effective 22 March 2024) prevail over earlier rules where they conflict. Counting runs cumulatively from 1 January of the current year.
| Situation (non-CII operator unless stated) | Route | Source |
|---|---|---|
| Necessary for a contract with the individual (cross-border shopping, payments, visas, bookings), cross-border HR management, or an emergency | Exempt from assessment, standard contract and certification | Provisions Art. 5 |
| Fewer than 100,000 people's non-sensitive personal information | Exempt | Provisions Art. 5(4) |
| 100,000 to under 1 million people's non-sensitive data, or under 10,000 people's sensitive data | CAC standard contract or personal information protection certification | Provisions Art. 8 |
| 1 million or more non-sensitive, 10,000 or more sensitive, any important data, or any export by a CII operator | CAC security assessment, valid three years | Provisions Arts. 7 and 9 |
| Data not on a free trade zone's negative list, exported from that zone | Exempt | Provisions Art. 6 |
The standard contract must follow the CAC template without conflicting additions, must be in effect before any transfer, and is filed with the provincial CAC within 10 working days with the PIPIA (Standard Contract Measures, CAC Order No. 13, Arts. 6 and 7). Changes in purpose, recipient, storage location or the recipient country's law trigger a new PIPIA and re-filing (Art. 8). The certification route is governed by measures from the CAC and the State Administration for Market Regulation, in force from 1 January 2026; certificates are valid for three years and splitting exports to stay under thresholds is prohibited. The Network Data Security Management Regulations (State Council Decree 790, in force 1 January 2025) restate the routes in Art. 35 and add a legal duty limb.
Data that never touched China: personal information collected abroad, processed in China and re-exported without adding domestic data is exempt (Provisions Art. 4).
Localisation and important data
The GDPR regulates where data goes, not where it must stay. The PIPL does both. Art. 40 requires CII operators and handlers that reach CAC volume thresholds to store personal information collected in China within China, with export only after a security assessment. Separately, important data (a Data Security Law concept) needs a security assessment before export, but only data that regional or sectoral authorities have identified or published as important needs declaring (Provisions Art. 2; Decree 790 Art. 37). Handlers of personal information of more than 10 million people also take on the important data governance duties in Decree 790 Arts. 30 and 32, including a named data security head. The Data Localisation Laws Map places China beside other localising regimes.
Architecture choice follows from this: a single global data lake fed from China is the hardest design to defend. A common pattern is a China region for collection and primary processing, minimised exports, and every export logged against the annual counters.
Incidents, audits and enforcement
Incident notice. GDPR Art. 33(1) requires notice to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, and Art. 34 adds data subjects where the risk is high. PIPL Art. 57 requires immediate remedial action and notice to regulators and individuals covering the data categories, cause, possible harm, remedial steps, steps individuals can take and contact details; it sets no hour count. Decree 790 Art. 11 adds notice to affected parties by phone, SMS, instant message, email or public notice. On top of that, the National Cybersecurity Incident Reporting Management Measures (in force 1 November 2025) require network operators to report qualifying incidents to the provincial CAC within 4 hours, central and state organs within 2 hours and CII operators within 1 hour, through channels including the 12387 hotline. See the China Cybersecurity Incident Reporting Measures Guide.
Implementing rules change often, so confirm thresholds before relying on them. mandates regular compliance audits (Art. 54) and the CAC's audit measures, in force since 1 May 2025, set a cycle of at least once every two years for handlers of more than 10 million people. See China Personal Information Protection Compliance Audits.Exposure. Fine ceilings are in the comparison table above. The practical difference is personal: PIPL Art. 66 lets regulators fine responsible individuals and bar them from director, senior management and officer roles, and GDPR transfer breaches sit in the Art. 83(5) top tier.
When to lead with which law
- EU-headquartered, small China footprint: run GDPR as the master framework, and maintain a China annex covering the Art. 13 basis map, separate consent, export routing and Chinese notices.
- Large China user base or CII designation: design China as its own data region first. Localisation and assessment duties will drive architecture more than anything in the GDPR.
- Chinese company serving EU customers: GDPR Art. 3(2) applies, so appoint an Art. 27 representative and treat EU data flowing to China as a Chapter V transfer, with Provisions Art. 4 easing the Chinese side for re-exported foreign data.
Where identity fits
Export counts and access rules are enforced through identities. Service accounts, API keys and integration tokens that let a European analytics job read a China database are, in effect, the export channel: each one should be inventoried, scoped to the minimised dataset the PIPIA describes, and logged so the annual export count can be evidenced. Remote administration from outside China can itself be a transfer, so register boundary-crossing credentials with the transfer. For the wider model see Human vs Non-Human Identity.
Implementing a dual programme
- Inventory flows by direction. Extend the ROPA with origin, destination, sensitive flags under both Art. 9 GDPR and Art. 28 PIPL, and the machine identities that move the data.
- Re-base every legitimate interests activity. Assign a PIPL Art. 13 ground or redesign the activity; record the decision.
- Build separate consent capture. One event per trigger, versioned notices in Chinese, withdrawal paths that stop processing and exports.
- Count exports. Implement a counter of unique individuals exported since 1 January, split sensitive and non-sensitive, with alerts at 80,000 and 8,000 so the route can change before a threshold is crossed.
- Choose routes and paper them. SCCs and a transfer impact assessment for EU to China; CAC standard contract plus PIPIA and filing, certification or assessment for China outward.
- Merge assessments. Use one assessment template with a GDPR DPIA section and a PIPIA section, so a single review covers both; see the DPIA Guide.
- Join the incident runbooks. One triage, three clocks: 4 hours (or 1 hour for CII) for the China incident report, immediate PIPL notice, 72 hours for GDPR.
- Test and roll back. Pilot new consent flows and export routing in one product or region first; keep the previous transfer route documented until the new filing is accepted, and halt exports if a threshold or filing lapses.
Detection and measurement
- Export headroom: unique individuals exported year to date against the 100,000, 1 million and 10,000 sensitive thresholds.
- Basis coverage: percentage of China processing activities with a recorded Art. 13 ground (target 100%, none citing legitimate interests).
- Separate consent integrity: exports or shares executed without a matching consent event, from log reconciliation (target zero).
- Filing currency: standard contracts filed within 10 working days and assessments renewed before the 60 working day window closes.
- Incident clock performance: time from detection to China report and to GDPR notice in exercises and real events.
- Boundary credentials: machine identities crossing the China boundary without an owner or linked transfer record.
Framework mapping
| Need | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Track both laws' obligations | GV.OC-03 | PT-2 Authority to Process PII |
| Purpose and basis per activity | ID.AM-07 | PT-3 PII Processing Purposes |
| Consent and notice | GV.OC-03 | PT-4 Consent, PT-5 Privacy Notice |
| DPIA and PIPIA | ID.AM-07 | RA-8 Privacy Impact Assessments |
| Location of processing and export control | PR.DS-01, PR.DS-02 | SA-9(5) Processing, Storage, and Service Location; AC-21 Information Sharing |
| Identities that move data | PR.AA-01, PR.AA-05 | AC-2 Account Management, IA-9 Service Identification and Authentication |
| Incident notice | RS.CO-02 | IR-6 Incident Reporting |
Common failure patterns
- Copying legitimate interests into the China notice: the basis does not exist under Art. 13, so the processing has no ground.
- Bundled consent: one checkbox covering terms, sharing and export fails the separate consent requirement for each trigger.
- Counting per system instead of per year: the threshold is cumulative unique individuals since 1 January across all exports, so several small pipelines can add up to an assessment.
- One SCC for both directions: EU SCCs do nothing for exports from China, and the CAC standard contract does nothing for GDPR Chapter V.
- Running only the 72 hour clock: China's 4 hour operator report and PIPL's "immediately" are missed when the GDPR runbook is the only one.
Practitioner checklist
- Map each processing activity to a GDPR Art. 6 basis and a PIPL Art. 13 ground.
- Retire legitimate interests for every China activity and record the replacement.
- Capture separate consent per trigger: sharing, disclosure, sensitive data, export.
- Count exported individuals since 1 January and alert before thresholds.
- Use SCCs for EU to China and a CAC route plus PIPIA for China outward.
- Appoint the PIPL officer where thresholds apply and a China representative if Art. 3(2) catches you.
- Run one incident triage with 1, 2 or 4 hour, immediate and 72 hour clocks.
- Scope machine credentials that cross the China boundary to the assessed dataset.
Standards and references
- EUR-Lex: Regulation (EU) 2016/679, General Data Protection Regulation
- Stanford DigiChina: Translation, Personal Information Protection Law of the People's Republic of China
- CAC: Provisions on Promoting and Regulating Cross-Border Data Flows (Order No. 16)
- CAC: Measures on the Standard Contract for Outbound Transfer of Personal Information (Order No. 13)
- CAC: Measures for Personal Information Export Certification announcement
- State Council: Network Data Security Management Regulations (Decree 790)
- CAC: National Cybersecurity Incident Reporting Management Measures Q&A
- European Commission: Adequacy decisions
This guide compares the GDPR and China's PIPL as of 14 November 2026 and is not legal advice. Related NHI Mgmt Group resources: China PIPL Guide · China Data Laws Compared · GDPR Compliance Guide for Security Teams · GDPR vs LGPD · International Data Transfers Map