Personal data regimes compared — GDPR vs PIPL
One question: how does each side decide when personal data may be processed, and what happens when it goes wrong? Short answer: the skeleton is similar; the keystone is different. The GDPR's flexible basis is legitimate interests; PIPL has no such basis, so consent carries far more weight — and China adds a second, stricter layer: separate consent.
Evidence grades (defined in
00-overview.md): A primary text, checked live; B other official source or a direct reading of the primary text; C our own comparison or inference, or not yet checked.
1. The table
| Dimension | EU — GDPR | China — PIPL | Grade |
|---|---|---|---|
| Source | Regulation (EU) 2016/679 | Personal Information Protection Law | A |
| Applicable since | 2018-05-25 | 2021-11-01 | A |
| Territorial scope | Article 3 — establishment in the EU, or offering goods/services to or monitoring people in the EU | Article 3 — processing in China, or processing abroad that targets people in China or analyses their behaviour | A |
| Lawful bases | Article 6 — consent, contract, legal obligation, vital interests, public task, legitimate interests | Article 13 — consent, contract, HR management, legal duty, public-health emergency, news/public-opinion supervision, other law. No legitimate interests. | A |
| Consent | freely given, specific, informed, unambiguous; explicit for special categories | consent, plus separate consent for sensitive data, cross-border transfer, disclosure and public disclosure | A |
| Sensitive data | Article 9 — nine special categories (race, politics, religion, trade union, genetic, biometric-for-ID, health, sex life, orientation) | Article 28 — biometrics, religious belief, specific identity, medical and health, financial accounts, whereabouts, and all data of under-14s | A |
| Rights | Articles 12–22 — access, rectification, erasure, restriction, portability, objection, automated decisions | Articles 44–50 — knowledge, decision, access/copying, correction, deletion, portability, explanation of automated decisions | A |
| Accountability figure | Data protection officer (Articles 37–39) | Person responsible for protection (Article 52) | A |
| Impact assessment | DPIA (Article 35) | Impact assessment (Articles 55–56) | A |
| Breach notice | Article 33 — authority within 72 hours; individuals if high risk | Article 57 — notify the authority and affected individuals | A |
| Cross-border | Chapter V (44–49) — adequacy, SCCs, BCRs, derogations | Article 38 — security assessment, certification, or standard contract (plus 2024 relaxations) | B |
| Penalties | Article 83 — up to EUR 10m or 2%; EUR 20m or 4% of worldwide turnover | Article 66 — up to RMB 1m for ordinary violations; for serious violations up to RMB 50m or 5% of prior-year turnover, plus suspension, business suspension, licence revocation and personal liability | A |
| Regulator | national supervisory authorities + EDPB | CAC and other departments with data-protection duties | B |
2. Five observations
- Same skeleton, different keystone. The GDPR's escape hatch for ordinary business processing is legitimate interests, subject to a balancing test and a right to object. PIPL has no equivalent, so where there is no contract or legal duty, consent does the work. — C
- Separate consent is a distinct device. Under PIPL, the highest-risk acts need a second, specific consent on top of ordinary consent. The GDPR's nearest analogue is "explicit consent", and it is confined to special categories and similar cases. — A
- The penalty arithmetic differs. The GDPR takes a slice of worldwide turnover; PIPL caps at a fixed RMB 50m or 5% of prior-year turnover, and adds non-monetary sanctions (suspension, licence revocation) plus personal liability for responsible individuals. — A
- Both reach offshore, differently. The GDPR exports a rights-and-transfers model; PIPL exports a security-and-assessment model with three gateways and periodic relaxation of thresholds. — C
- Convergence is underrated. Both require a named accountability figure and a documented impact assessment before high-risk processing — closer than the usual "EU strict, China different" framing suggests. — C
3. What this means in practice
- Processing in both markets: one template will not do. Legitimate interests will not carry you in China; separate consent has no GDPR equivalent to slot into. — C
- Cross-border flows: the EU trusts an adequacy finding or standard clauses; China requires an act per flow — assessment, contract or certification. — B
- Sensitive data: China's list is broader in an everyday sense (financial accounts, whereabouts) and includes all data of children under 14 by definition. — A
4. Limits and unverified ⚠
- Article numbers and wording in the table are taken from the linked primary texts; a punctuation-level proof-read of every provision is still pending, and the open TODOs on the two cards still apply. — B
- The 2024 cross-border relaxations and their exemption thresholds need checking against the official text. — C ⚠
- The Cybersecurity Law was amended on 2025-10-28 and re-promulgated with its articles renumbered (in force 2026-01-01); any Cybersecurity Law article number cited from the older text must be re-checked. — A
5. Official sources
- GDPR (EUR-Lex): https://eur-lex.europa.eu/eli/reg/2016/679/oj
- PIPL (NPC): http://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html
- Provisions on Promoting and Regulating Cross-Border Data Flows: https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm