Cross-border data regimes compared — GDPR Chapter V vs China's 2024 provisions
English · 中文
One question: when may personal data leave the country? Short answer: the EU decides at the country level and then lets data move; China decides at the flow level and only opens a route once you cross a numeric threshold.
Evidence grades (defined in
00-overview.md): A primary text, checked live; B other official source or a direct reading of the primary text; C our own comparison or inference, or not yet checked.
1. The table
| Dimension | EU | China | Grade |
|---|---|---|---|
| Instrument | GDPR Chapter V (Articles 44–49) | PIPL Article 38 + the 2024 Provisions (CAC Order No. 16) | A |
| Routes | adequacy decision; appropriate safeguards (SCCs, BCRs, codes, certification); narrow derogations | security assessment; filed standard contract; certification | A |
| Unit of decision | country-level (adequacy) or contract-level (SCCs) | flow-level, by exporter and by volume | B |
| Default posture | transfer permitted once a route applies | transfer permitted only through a specific route, and only above the exemption line | B |
| Thresholds | none | non-CIIO only: under 100,000 individuals' PI with no sensitive PI and no important data → nothing to do; 100,000–1,000,000 non-sensitive, or under 10,000 sensitive → contract or certification; 1,000,000+ non-sensitive, 10,000+ sensitive, or any important data → security assessment. Sensitive PI has no small-volume exemption | A |
| Who you are | no equivalent trigger | CIIO status pulls any transfer of personal information or important data into security assessment, whatever the volume (Art. 7(1)) | A |
| Multi-national group | BCRs (a formal approval process) | the 2024 Provisions exempt certain HR-management transfers | A |
| Sector-specific trigger | none in the GDPR itself | important data — but only data a department or region has told you, or publicly listed, as important (Art. 2) | A |
| Filing | none for SCCs; BCRs need approval | standard contracts must be filed with the provincial CAC | A |
| Exemptions | Article 49 derogations, read narrowly | 2024 Provisions list trade, academic cooperation, emergency, HR and small-volume exemptions (Arts. 3–6) | A |
| Result validity | adequacy reviewed periodically | security assessment result valid 3 years, extendable once by another 3 (Art. 9) | A |
| Penalties | GDPR Article 83 (up to 4% of worldwide turnover) | PIPL Article 66 (up to RMB 50m or 5% of prior-year turnover) | A |
2. Five observations
- Trust abroad vs permission for the flow. The EU asks "is this country adequate?" and then data moves. China asks "how much is leaving from this exporter?" and prescribes an act. The first is faster once granted; the second is more predictable per flow. — C
- Numbers make China's regime legible. Because the triggers are volume-based, a compliance team can compute whether it needs anything — which is exactly why the 2024 relaxation did so much for multinationals. — C
- Both treat HR data as the awkward case. The EU route is BCRs; China wrote an exemption. Same problem, opposite fixes. — C
- Important data and CIIO have no EU analogue. In China a flow can be pulled into security assessment because of what the data is or who the exporter is, not just how much. — A
- The practical consequence: an EU-only playbook does not satisfy China. If you operate in both, you need adequacy plus SCCs for the EU side, and separate volume maths plus a filing or assessment for the Chinese side. — C
3. What it means for a company in both markets
- Keep two transfer registers, not one: one keyed by destination country, one keyed by annual volume per exporter. — C
- Do not assume the standard contract is portable — China's must be filed, the EU's are pre-approved clauses. — A
- Watch the free-trade-zone negative lists in China; they create genuinely different rules inside one country. — C
- Treat the small-volume exemption as open to non-sensitive personal information only: one sensitive record takes you out of it. — A
4. Limits and unverified ⚠
- The Chinese thresholds have been read article by article against the official text — Articles 5, 7 and 8 — on 2026-10-07. — A
- The certification measure, CAC and SAMR Order No. 20, was published 2025-10-14 and takes effect only on 2026-01-01. Until then the certification route rests on the 2024 Provisions and the pre-existing certification rules, not on that order. — A
- Sectoral "important data" catalogues are still issued piecemeal. — B
- Adequacy decisions and the EU–US Data Privacy Framework's status change over time. — C
5. Official sources
- GDPR (EUR-Lex): https://eur-lex.europa.eu/eli/reg/2016/679/oj
- 2024 Provisions (CAC): https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm
- Measures for Certification of Personal Information Export (CAC): https://www.cac.gov.cn/2025-10/17/c_1762449728720008.htm
- Q&A on the 2024 Provisions (MOFCOM policy portal): https://policy.mofcom.gov.cn/claw/policyInfo.shtml?id=6170
- PIPL (NPC): http://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html