The GDPR is the most stringent data protection regime in the world. Breach of the core processing principles may attract a fine of up to EUR 20 million or 4% of global annual turnover. Meta was fined EUR 1.2 billion for unlawful EU-US data transfers — the largest penalty in the history of the GDPR.
Three mechanisms for cross-border transfer
Mechanism one: adequacy decision
Where the European Commission has determined that the level of data protection in a third country is essentially equivalent to that in the Union, data may flow freely.
| Adequacy recognised | Condition |
|---|---|
| United States (participants in the DPF) | The undertaking must be certified under the EU-US Data Privacy Framework |
| Republic of Korea | Adequacy confirmed as continuing in July 2026 |
| Uruguay | — |
| European Patent Organisation | — |
Mechanism two: standard contractual clauses
In June 2021 the European Commission adopted new SCC templates in four modules:
| Module | Scenario |
|---|---|
| Module 1 | Controller to controller (data transfer) |
| Module 2 | Controller to processor, including the Article 28 processing obligations |
| Module 3 | Processor to processor (sub-processing) |
| Module 4 | Processor to controller |
Key requirement: before the SCCs are adopted, a transfer impact assessment (TIA) must be carried out, assessing whether the law of the destination country may impede the processor’s performance of its SCC obligations. Where an impediment is found, supplementary measures are required.
Mechanism three: binding corporate rules
A mechanism for intra-group transfers within a multinational group, requiring approval by the supervisory authority of the relevant Member State.
The eight data subject rights
| Right | Article | Content |
|---|---|---|
| Right to be informed | Articles 12 and 14 | To be told the purposes, legal basis and retention period |
| Right of access | Article 15 | A copy of the personal data |
| Right to rectification | Article 16 | Correction of inaccurate data |
| Right to erasure | Article 17 | Deletion, the “right to be forgotten” |
| Right to restriction | Article 18 | Restriction of processing while a dispute is resolved |
| Right to data portability | Article 20 | Receipt and transfer in a machine-readable format |
| Right to object | Article 21 | Objection to processing, including direct marketing |
| Rights on automated decisions | Article 22 | Not to be subject to decisions based solely on automated processing |
The data protection impact assessment
Triggers (Article 35)
Where processing, particularly with new technology, is likely to result in a high risk to the rights and freedoms of individuals, a DPIA must be carried out before processing begins:
| Trigger | Description |
|---|---|
| Large-scale systematic monitoring | Such as AI surveillance systems |
| Large-scale processing of sensitive data | Such as biometric or health data |
| Large-scale processing of children’s data | — |
| Automated decision-making, including profiling | Producing legal or similarly significant effects |
Content of a DPIA
- A description of the purposes and means of processing
- An assessment of necessity and proportionality in relation to data subject rights
- Identification and assessment of risk
- The measures envisaged to mitigate risk
Obligations of processors (Article 28)
| Obligation | Content |
|---|---|
| Processing only on instructions | Processing on the documented instructions of the controller |
| Confidentiality | Authorised personnel to be bound by confidentiality |
| Security measures | Technical and organisational measures |
| Control of sub-processing | No sub-processor without authorisation |
| Assistance | Assistance with the DPIA and with breach notification |
| Deletion or return | Deletion or return of data at the end of the service |
| Audit | Submission to audit by the controller |
The penalty regime
| Tier | Maximum fine | Scope |
|---|---|---|
| Highest | EUR 20 million or 4% of global annual turnover | Breach of core principles, data subject rights or international transfer rules |
| Middle | EUR 10 million or 2% of global annual turnover | Failure to keep records, failure to appoint a DPO, inadequate breach notification |
Significant enforcement decisions
| Undertaking | Fine | Reason |
|---|---|---|
| Meta | EUR 1.2 billion | Unlawful EU-US data transfers |
| TikTok | EUR 530 million | Unlawful EU-China data transfers |
| Amazon | EUR 746 million | Targeted advertising without valid consent |
| EUR 405 million | Breach of children’s data protection | |
| EUR 310 million | Invalid legal basis for processing |
Compliance points for Chinese companies
Scenarios
| Scenario | Obligation |
|---|---|
| Offering AI services to users in the Union | Full GDPR obligations |
| Processing personal data of users in the Union | Valid legal basis required |
| Transferring EU user data back to China | SCCs plus a TIA, BCRs or an adequacy decision |
| Deploying AI model nodes in the Union | DPIA and protection of data subject rights |
The EU-China transfer route
- Check the adequacy list — China is not on it.
- Sign the SCCs — select the appropriate module, usually Module 2 (controller to processor).
- Carry out a TIA — assess whether Chinese law affects performance of the SCC obligations.
- Adopt supplementary measures — encryption, pseudonymisation and similar measures where the TIA identifies risk.
- Protect data subject rights — provide channels through which the rights in Articles 12 to 22 may be exercised.
PIPL and GDPR compared
| Dimension | GDPR | PIPL |
|---|---|---|
| Transfer mechanisms | SCCs, adequacy decisions, BCRs | Security assessment, certification, standard contract |
| Data localisation | No general requirement | Required for operators of critical information infrastructure |
| Automated decision-making | Article 22 | Article 24, with greater emphasis on transparency and the right to refuse |
| Legal basis | Includes “legitimate interests” | Greater emphasis on consent and statutory grounds |
| Maximum fine | EUR 20 million or 4% | RMB 50 million or 5% |
Frequently asked questions
Q: We call an offshore API to process EU user data. Does GDPR compliance apply? A: Yes. Where the API provider is outside the Union, such as in the United States, the movement of data from the Union to that provider is a restricted transfer, requiring SCCs and a TIA or another appropriate safeguard. TikTok was fined EUR 530 million in respect of EU-China transfers.
Q: Is signing the SCCs sufficient? A: No. A TIA must be carried out before the SCCs are signed, assessing whether the law of the destination country affects the SCC obligations. Where the TIA identifies risk, supplementary measures such as encryption and pseudonymisation are also required.
Q: Can a single privacy policy serve both China and the EU? A: It is not advisable. The requirements of the PIPL and the GDPR differ, for example on data localisation, separate consent and transfer mechanisms, and a jurisdiction-specific approach is preferable.
This article is prepared on the basis of the GDPR (Regulation (EU) 2016/679) and the 2021 SCC templates. For assistance with GDPR compliance or a data export security assessment, please contact Geason Law Offices.