Use this comparison to separate PIPL and GDPR scope, roles, legal bases, rights, assessments, breach response, transfers, and enforcement.
The laws share lifecycle controls, but a GDPR controller analysis, lawful basis, DPIA, or EU transfer mechanism does not replace the corresponding PIPL decision.
China's Personal Information Protection Law (PIPL) and the EU General Data Protection Regulation (GDPR) overlap, but compliance with one does not establish compliance with the other. Both can apply outside their home territory, regulate decision-makers and vendors, require lawful processing and security, grant individual rights, and restrict international transfers. They use different territorial tests, legal roles, consent rules, impact-assessment triggers, breach duties, and transfer mechanisms. Test both laws for each processing activity and keep the two legal conclusions in the record.
Comparison
China PIPL vs EU GDPR
Compare territorial reach, roles, legal bases, sensitive data, rights, impact assessments, breaches, transfers, and enforcement. Apply each law independently.
PIPL applies to processing personal information in China. It also reaches overseas processing intended to provide products or services to people in China, analyze or assess their behavior, or meet another condition set by law or regulation. An overseas processor within that rule must establish an institution or appoint a representative in China.
Articles 3 and 53 establish PIPL's in-China and overseas scope tests and the China institution-or-representative duty.
GDPR applies to processing in the context of an EU establishment regardless of where processing occurs. It also reaches a non-EU controller or processor offering goods or services to, or monitoring behavior of, people in the EU when the behavior occurs there. Article 27 generally requires a written EU representative for Article 3(2) processing, subject to its exceptions.
Articles 3 and 27 establish EU-establishment, offering, and monitoring scope and the representative rule and exceptions.
Record the establishment, targeting, or monitoring facts under GDPR and the in-China or overseas ground under PIPL; neither territorial result determines the other.
A personal information processor decides the purpose and method. An entrusted processor handles information under an agreement stating the purpose, duration, method, categories, protection measures, and parties' rights and duties; the processor must supervise it. Joint decision-makers agree their duties and can face joint liability.
Articles 20-21 govern joint decision-makers, entrusted processing terms, supervision, sub-entrustment, and return or deletion.
A controller determines purposes and means. A processor acts on documented instructions under an Article 28 contract and has specified direct duties. Joint controllers must transparently allocate responsibilities under Article 26 without removing data-subject rights against either controller.
Article 13 permits processing under consent or listed non-consent circumstances, including necessity to conclude or perform a contract with the individual, human-resources necessity under lawfully formulated employment rules and a lawfully concluded collective contract, legal duties, emergencies, specified news and public-interest activities, and reasonable processing of lawfully public information. When processing relies on consent, separate consent applies to specified disclosures, sensitive personal information, and overseas provision.
Articles 13-18 establish processing circumstances, consent and withdrawal, separate-consent overlays, and notice duties.
Article 6 provides six lawful bases: consent, contract, legal obligation, vital interests, public task, and legitimate interests, with limits on the last basis for public authorities. Consent must satisfy Articles 4(11) and 7. Special-category data also needs an Article 9(2) exception; Article 6 alone is insufficient.
Sensitive personal information is information that, if leaked or illegally used, can readily harm dignity or personal or property safety. It includes biometrics, religious belief, specific identity, medical health, financial accounts, location tracking, and information of children under 14. Processing requires a specific purpose, sufficient necessity, strict safeguards, additional notice, a pre-processing PIPIA, and, when processing relies on consent, separate consent.
Articles 28-32 define sensitive personal information and set purpose, necessity, notice, consent, child-data, and safeguard duties.
Article 9 special categories are racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used for unique identification, health data, and sex-life or sexual-orientation data. Processing is prohibited unless an Article 9(2) condition applies. Criminal-conviction data is governed separately by Article 10.
Articles 9-10 define special-category and criminal-conviction data rules and their conditions.
Maintain separate classification fields. Data may fall within one protected category but not the other, and each category changes a different legal test.
Individuals have rights to know and decide, restrict or refuse processing, access and copy, correct, and delete, subject to statutory conditions. For an automated decision with a major effect on rights or interests, an individual may request an explanation and may refuse such a decision made solely through automation. A rejected rights request must be explained, and the individual may sue.
Articles 24 and 44-50 establish individual rights, automated-decision protections, request mechanisms, rejection reasons, and judicial recourse.
Data subjects have rights to information, access, rectification, erasure, restriction, portability, objection, and safeguards for decisions based solely on automated processing. The controller generally must respond without undue delay and within one month, extendable by two further months for complexity or volume if the person is told within the first month.
Article 55 requires a PIPIA before sensitive-information processing, automated decision-making, entrusted processing, provision to another processor, public disclosure, overseas provision, and other processing with a major effect on individuals. The report and processing record must be kept for at least three years. Article 54 separately requires regular compliance audits.
Articles 54-56 establish compliance audits, PIPIA triggers and content, and the minimum three-year retention period.
Article 35 requires a DPIA before processing likely to result in high risk, especially specified systematic evaluations with significant effects, large-scale special-category or criminal-conviction processing, and large-scale systematic monitoring of public areas. Supervisory-authority lists can add or clarify triggers. Article 30 separately requires records of processing, subject to a limited exception for some organizations under 250 employees.
If personal information is or may be leaked, altered, or lost, the processor must immediately take remedial measures and notify the authorities and individuals with the information listed in Article 57. Individual notice may be omitted if the processor can effectively avoid harm, but an authority may still require it. PIPL does not state a fixed 72-hour period.
Article 57 establishes immediate remediation and authority and individual notification duties without stating a fixed hour count.
A controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after awareness unless the breach is unlikely to risk people's rights and freedoms. It must communicate a high-risk breach to affected people without undue delay unless an Article 34 exception applies. Processors notify controllers without undue delay.
Before overseas provision, PIPL generally requires recipient notice, separate consent where consent is required, a PIPIA, and one Article 38 route unless a current exemption applies. Under the 2024 provisions, non-critical-information-infrastructure operators generally use a standard contract or certification when they export personal information of at least 100,000 but fewer than 1 million individuals, excluding sensitive personal information, or sensitive personal information of fewer than 10,000 individuals, counted from 1 January of the current year. A CAC assessment is required for critical information infrastructure operators, important data, personal information of at least 1 million individuals excluding sensitive personal information, or sensitive personal information of at least 10,000 individuals, subject to stated exemptions.
Use for current export exemptions, thresholds, three-year assessment validity and precedence over inconsistent older measures.
Chapter V permits transfer on an adequacy decision, appropriate safeguards such as the EU standard contractual clauses or binding corporate rules, or a limited Article 49 derogation. All Chapter V conditions must preserve GDPR protection, including for onward transfers. The chosen mechanism does not remove the rest of the GDPR duties.
Articles 44-49 establish adequacy, safeguard, binding-corporate-rule, and derogation routes and the general protection requirement.
For each China-EU flow, record the direction and which transfer rules apply. Where both are triggered, the CAC standard contract and EU standard contractual clauses remain different instruments with different legal tests.
For a serious PIPL violation, the responsible authority may order correction, confiscate unlawful gains, and impose up to RMB 50 million or 5% of the prior year's turnover. It may also suspend related business or order suspension for rectification, notify competent authorities to revoke relevant permits or a business licence, and fine or disqualify directly responsible individuals. Lesser violations have a different penalty tier.
Article 66 establishes corrective orders and the ordinary and serious-violation penalty tiers, including the RMB 50 million or 5% ceiling.
For infringements in GDPR Article 83(5), including core principles, data-subject rights, and international-transfer rules, a supervisory authority may impose up to EUR 20 million or 4% of the undertaking's total worldwide annual turnover from the preceding financial year, whichever is higher. Article 83 requires a case-specific assessment, and other infringement tiers and corrective powers also apply.
Article 83 requires EU-specific tier and case-factor analysis.
Territorial reach
China PIPL
PIPL applies to processing personal information in China. It also reaches overseas processing intended to provide products or services to people in China, analyze or assess their behavior, or meet another condition set by law or regulation. An overseas processor within that rule must establish an institution or appoint a representative in China.
Articles 3 and 53 establish PIPL's in-China and overseas scope tests and the China institution-or-representative duty.
EU GDPR
GDPR applies to processing in the context of an EU establishment regardless of where processing occurs. It also reaches a non-EU controller or processor offering goods or services to, or monitoring behavior of, people in the EU when the behavior occurs there. Article 27 generally requires a written EU representative for Article 3(2) processing, subject to its exceptions.
Articles 3 and 27 establish EU-establishment, offering, and monitoring scope and the representative rule and exceptions.
Operational implication
Record the establishment, targeting, or monitoring facts under GDPR and the in-China or overseas ground under PIPL; neither territorial result determines the other.
GDPR Articles 3 and 27 do not determine PIPL territorial coverage.
Core roles
China PIPL
A personal information processor decides the purpose and method. An entrusted processor handles information under an agreement stating the purpose, duration, method, categories, protection measures, and parties' rights and duties; the processor must supervise it. Joint decision-makers agree their duties and can face joint liability.
Articles 20-21 govern joint decision-makers, entrusted processing terms, supervision, sub-entrustment, and return or deletion.
EU GDPR
A controller determines purposes and means. A processor acts on documented instructions under an Article 28 contract and has specified direct duties. Joint controllers must transparently allocate responsibilities under Article 26 without removing data-subject rights against either controller.
GDPR Articles 26 and 28 do not replace PIPL entrusted-processing requirements.
Processing basis and consent
China PIPL
Article 13 permits processing under consent or listed non-consent circumstances, including necessity to conclude or perform a contract with the individual, human-resources necessity under lawfully formulated employment rules and a lawfully concluded collective contract, legal duties, emergencies, specified news and public-interest activities, and reasonable processing of lawfully public information. When processing relies on consent, separate consent applies to specified disclosures, sensitive personal information, and overseas provision.
Articles 13-18 establish processing circumstances, consent and withdrawal, separate-consent overlays, and notice duties.
EU GDPR
Article 6 provides six lawful bases: consent, contract, legal obligation, vital interests, public task, and legitimate interests, with limits on the last basis for public authorities. Consent must satisfy Articles 4(11) and 7. Special-category data also needs an Article 9(2) exception; Article 6 alone is insufficient.
A GDPR Article 6 basis and any Article 9 exception do not establish a PIPL circumstance.
Sensitive data and assessments
China PIPL
Sensitive personal information is information that, if leaked or illegally used, can readily harm dignity or personal or property safety. It includes biometrics, religious belief, specific identity, medical health, financial accounts, location tracking, and information of children under 14. Processing requires a specific purpose, sufficient necessity, strict safeguards, additional notice, a pre-processing PIPIA, and, when processing relies on consent, separate consent.
Articles 28-32 define sensitive personal information and set purpose, necessity, notice, consent, child-data, and safeguard duties.
EU GDPR
Article 9 special categories are racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used for unique identification, health data, and sex-life or sexual-orientation data. Processing is prohibited unless an Article 9(2) condition applies. Criminal-conviction data is governed separately by Article 10.
Articles 9-10 define special-category and criminal-conviction data rules and their conditions.
Operational implication
Maintain separate classification fields. Data may fall within one protected category but not the other, and each category changes a different legal test.
GDPR Articles 9-10 do not define the PIPL sensitive-personal-information category.
Individual rights
China PIPL
Individuals have rights to know and decide, restrict or refuse processing, access and copy, correct, and delete, subject to statutory conditions. For an automated decision with a major effect on rights or interests, an individual may request an explanation and may refuse such a decision made solely through automation. A rejected rights request must be explained, and the individual may sue.
Articles 24 and 44-50 establish individual rights, automated-decision protections, request mechanisms, rejection reasons, and judicial recourse.
EU GDPR
Data subjects have rights to information, access, rectification, erasure, restriction, portability, objection, and safeguards for decisions based solely on automated processing. The controller generally must respond without undue delay and within one month, extendable by two further months for complexity or volume if the person is told within the first month.
GDPR Articles 12 and 15-22 supply EU-specific rights, exceptions, and timing.
Impact assessments and records
China PIPL
Article 55 requires a PIPIA before sensitive-information processing, automated decision-making, entrusted processing, provision to another processor, public disclosure, overseas provision, and other processing with a major effect on individuals. The report and processing record must be kept for at least three years. Article 54 separately requires regular compliance audits.
Articles 54-56 establish compliance audits, PIPIA triggers and content, and the minimum three-year retention period.
EU GDPR
Article 35 requires a DPIA before processing likely to result in high risk, especially specified systematic evaluations with significant effects, large-scale special-category or criminal-conviction processing, and large-scale systematic monitoring of public areas. Supervisory-authority lists can add or clarify triggers. Article 30 separately requires records of processing, subject to a limited exception for some organizations under 250 employees.
GDPR Articles 30 and 35-36 control the EU records, DPIA, review, and prior-consultation analysis.
Personal-data breaches
China PIPL
If personal information is or may be leaked, altered, or lost, the processor must immediately take remedial measures and notify the authorities and individuals with the information listed in Article 57. Individual notice may be omitted if the processor can effectively avoid harm, but an authority may still require it. PIPL does not state a fixed 72-hour period.
Article 57 establishes immediate remediation and authority and individual notification duties without stating a fixed hour count.
EU GDPR
A controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after awareness unless the breach is unlikely to risk people's rights and freedoms. It must communicate a high-risk breach to affected people without undue delay unless an Article 34 exception applies. Processors notify controllers without undue delay.
Articles 33-34 supply the EU risk thresholds, recipients, and timing.
International transfers
China PIPL
Before overseas provision, PIPL generally requires recipient notice, separate consent where consent is required, a PIPIA, and one Article 38 route unless a current exemption applies. Under the 2024 provisions, non-critical-information-infrastructure operators generally use a standard contract or certification when they export personal information of at least 100,000 but fewer than 1 million individuals, excluding sensitive personal information, or sensitive personal information of fewer than 10,000 individuals, counted from 1 January of the current year. A CAC assessment is required for critical information infrastructure operators, important data, personal information of at least 1 million individuals excluding sensitive personal information, or sensitive personal information of at least 10,000 individuals, subject to stated exemptions.
Use for current export exemptions, thresholds, three-year assessment validity and precedence over inconsistent older measures.
EU GDPR
Chapter V permits transfer on an adequacy decision, appropriate safeguards such as the EU standard contractual clauses or binding corporate rules, or a limited Article 49 derogation. All Chapter V conditions must preserve GDPR protection, including for onward transfers. The chosen mechanism does not remove the rest of the GDPR duties.
Articles 44-49 establish adequacy, safeguard, binding-corporate-rule, and derogation routes and the general protection requirement.
Operational implication
For each China-EU flow, record the direction and which transfer rules apply. Where both are triggered, the CAC standard contract and EU standard contractual clauses remain different instruments with different legal tests.
GDPR Chapter V controls the separate EU transfer analysis.
Enforcement and maximum fines
China PIPL
For a serious PIPL violation, the responsible authority may order correction, confiscate unlawful gains, and impose up to RMB 50 million or 5% of the prior year's turnover. It may also suspend related business or order suspension for rectification, notify competent authorities to revoke relevant permits or a business licence, and fine or disqualify directly responsible individuals. Lesser violations have a different penalty tier.
Article 66 establishes corrective orders and the ordinary and serious-violation penalty tiers, including the RMB 50 million or 5% ceiling.
EU GDPR
For infringements in GDPR Article 83(5), including core principles, data-subject rights, and international-transfer rules, a supervisory authority may impose up to EUR 20 million or 4% of the undertaking's total worldwide annual turnover from the preceding financial year, whichever is higher. Article 83 requires a case-specific assessment, and other infringement tiers and corrective powers also apply.
Article 83 requires EU-specific tier and case-factor analysis.
1
Section 1
How to use this comparison
Start with territorial scope and roles. PIPL covers processing in China and specified overseas processing involving people in China. GDPR covers processing in the context of an EU establishment and specified offering or monitoring involving people in the EU. A PIPL personal information processor resembles a GDPR controller because each decides the relevant purpose and method or means, but the statutes assign duties in their own terms.
Then record a legal basis under each law. PIPL Article 13 lists consent and non-consent circumstances and, when processing relies on consent, adds separate consent for specified activities. GDPR Article 6 lists six lawful bases, while Article 9 separately prohibits processing special-category data unless an exception applies. A valid GDPR basis does not automatically satisfy PIPL.
Run high-risk and transfer reviews independently. PIPL requires a personal information protection impact assessment (PIPIA) before the activities listed in Article 55 and retains the report and processing record for at least three years. GDPR requires a data protection impact assessment (DPIA) where processing is likely to result in high risk. China export routes and EU GDPR Chapter V mechanisms are separate instruments, even when the same vendor and dataset are involved.
Record both territorial tests, entity roles, processing purposes, data categories, recipients, and retention periods.
Map each purpose to a PIPL Article 13 circumstance and a GDPR Article 6 basis; add the separate sensitive-data or special-category analysis.
Route individual requests under the correct right, exception, identity check, and deadline.
For each China-EU data flow, record its direction and test each law's transfer trigger. China's export rules concern overseas provision from China; GDPR Chapter V concerns transfers to third countries or international organizations. Where both regimes apply, neither the Cyberspace Administration of China (CAC) standard contract nor EU standard contractual clauses replace the other.
Use for PIPL scope, processing bases, notice and consent, individual rights, processor duties, PIPIA, cross-border transfer duties, penalties, and effective date.
Use for PIPL scope, processing bases, notice and consent, individual rights, processor duties, PIPIA, cross-border transfer duties, penalties, and effective date.
Articles 3 and 53 establish PIPL's in-China and overseas scope tests and the China institution-or-representative duty.
PIPL Articles 3 and 53 and GDPR Articles 3 and 27 require separate territorial and representative analyses.
Show 16 more
Articles 20-21 govern joint decision-makers, entrusted processing terms, supervision, sub-entrustment, and return or deletion.
PIPL Articles 20-21 impose role and contract rules separate from GDPR Articles 26 and 28.
Articles 13-18 establish processing circumstances, consent and withdrawal, separate-consent overlays, and notice duties.
PIPL Articles 13-18 require a distinct processing-circumstance and separate-consent analysis.
Articles 28-32 define sensitive personal information and set purpose, necessity, notice, consent, child-data, and safeguard duties.
PIPL Articles 28-32 create a protected category distinct from GDPR Articles 9-10.
Articles 24 and 44-50 establish individual rights, automated-decision protections, request mechanisms, rejection reasons, and judicial recourse.
PIPL Articles 24 and 44-50 require a separate rights and response analysis.
Articles 54-56 establish compliance audits, PIPIA triggers and content, and the minimum three-year retention period.
PIPL Articles 54-56 control the China assessment and audit record.
Article 57 establishes immediate remediation and authority and individual notification duties without stating a fixed hour count.
Article 57 supplies the China trigger and notice content.
Articles 38-40 establish China export routes, overseas-recipient notice and separate consent, and security-assessment duties.
PIPL Articles 38-40 and the 2024 provisions control the China export analysis.
Article 66 establishes corrective orders and the ordinary and serious-violation penalty tiers, including the RMB 50 million or 5% ceiling.
Article 66 uses China-specific remedies and penalty tiers.
Use for assessment self-assessment, filing materials, review procedure and reapplication triggers; use the 2024 provisions for current exemptions, thresholds and validity.
Use for the CAC standard-contract form, pre-export PIPIA, contract effectiveness, filing and re-filing procedure; use the 2024 provisions for current exemptions and volume bands.