An AI company serving users in both China and the European Union is subject to the PIPL and the GDPR at the same time. A single privacy policy covering both jurisdictions will not suffice: the two regimes differ materially on data localisation, transfer mechanisms and automated decision-making.
PIPL and GDPR compared
| Dimension | GDPR | PIPL |
|---|---|---|
| Legislative basis | Personal data protection as a fundamental right | A balance between individual interests and national security |
| Legal basis for processing | Consent, contract, legal obligation, legitimate interests and others | Greater emphasis on consent and statutory grounds; no “legitimate interests” |
| Transfer mechanisms | SCCs, adequacy decisions, BCRs | Security assessment, certification, standard contract |
| Data localisation | No general requirement | Required for operators of critical information infrastructure |
| Separate consent | Detailed rules | More explicit for provision to third parties, sensitive information and cross-border transfer |
| Automated decision-making | Article 22 | Article 24, with greater emphasis on transparency and the right to refuse |
| Impact assessment | DPIA | PIA |
| Maximum fine | EUR 20 million or 4% | RMB 50 million or 5% |
Data localisation requirements
Localisation under the PIPL
Operators of critical information infrastructure (CIIOs) and processors handling the personal information of more than one million individuals must store within China the personal information collected and generated in China.
| Situation | Localisation requirement |
|---|---|
| CIIO | Storage within China |
| Processing personal information of more than one million individuals | Storage within China |
| Important data | Storage within China |
No general localisation requirement under the GDPR
The GDPR does not impose general data localisation, but controls the outflow of data indirectly through transfer mechanisms such as SCCs with a TIA, and BCRs.
Recommended two-track approach
| Data type | Chinese user data | EU user data |
|---|---|---|
| Storage | Servers in China | May be stored in the EU or in China, subject to SCCs and a TIA |
| Transfer | Security assessment, certification or standard contract | SCCs with a TIA, or an adequacy decision |
| Localisation | Required for CIIOs or where more than one million individuals are concerned | No general requirement |
Transfer mechanisms compared
Transfers from China to a third country
Situations requiring a security assessment (Article 4 of the Measures for Security Assessment of Data Export):
| Situation | Threshold |
|---|---|
| Provision of important data outside China | No threshold |
| Provision of personal information by a CIIO | One million individuals or more |
| Cumulative provision of personal information outside China | 100,000 individuals |
| Cumulative provision of sensitive personal information outside China | 10,000 individuals |
Policy as at September 2026:
- A non-CIIO that has cumulatively provided personal information of between 100,000 and one million individuals (excluding sensitive information), or sensitive information of fewer than 10,000 individuals, may discharge its obligations by certification of personal information export.
- Splitting of volumes to avoid a security assessment is prohibited.
- Where certification has been obtained but the assessment threshold is later reached, the matter must be converted to a security assessment.
Transfers from the EU to a third country
| Mechanism | Condition |
|---|---|
| Adequacy decision | The destination country is recognised as equivalent (the US DPF, the Republic of Korea and others) |
| SCCs | Standard contractual clauses plus a TIA |
| BCRs | Intra-group, subject to approval |
The two-track transfer route
Scenario: a Chinese AI company processes EU user data and transfers it back to China
- Check whether China is on the EU adequacy list — it is not.
- Sign the SCCs, Module 2 (controller to processor) — required.
- Carry out a TIA — required, assessing whether Chinese law affects the SCC obligations.
- Where the TIA identifies risk, adopt encryption, pseudonymisation and similar measures.
- Ensure that channels for the exercise of data subject rights remain available.
Automated decision-making: the differences
Article 24 of the PIPL
- Transparency of decision-making and fairness of outcome must be ensured.
- Unreasonable differential treatment, such as differential pricing, is prohibited.
- Options not based on personal characteristics, or a convenient means of refusal, must be provided.
- For decisions with a significant effect, the individual may require an explanation and may refuse.
Article 22 of the GDPR
- A right not to be subject to a decision based solely on automated processing.
- A right to be informed of the logic of automated decision-making at the point of contracting.
- A right to require human intervention in decisions with a significant effect.
Two-track alignment
| Requirement | PIPL | GDPR |
|---|---|---|
| Transparency | Yes | Yes |
| Right to refuse | Yes, by a convenient means | Yes, not to be subject to solely automated decisions |
| Human review | Implied | Yes, human intervention expressly required |
| Prohibition of differential treatment | Yes, unreasonable differences expressly prohibited | Covered indirectly through the fairness principle |
| Option not based on personal characteristics | Yes | No express requirement |
The jurisdiction-specific approach
Privacy policy by jurisdiction
| Content | China version | EU version |
|---|---|---|
| Consent mechanism | Separate consent for sensitive information and cross-border transfer | Explicit consent or a legitimate basis |
| Transfer clause | Security assessment, certification or standard contract | SCCs and a TIA |
| Data subject rights | Access, correction, deletion, explanation | Access, rectification, erasure, restriction, portability, objection |
| Automated decisions | Convenient means of refusal | Human intervention |
| Data protection officer | Not mandatory | Mandatory in specified circumstances |
| Impact assessment | PIA | DPIA |
Technical architecture by jurisdiction
| Choice | Chinese users | EU users |
|---|---|---|
| Data storage | Servers in China | EU servers, or transfer under SCCs |
| Model deployment | Nodes in China | EU nodes, reducing cross-border transfer |
| Data processing | Chinese entity | EU entity or authorised representative |
| User verification | Real-name verification in China | GDPR-compatible verification |
Action list
| Priority | Action |
|---|---|
| P0 | Draft privacy policies and user terms by jurisdiction |
| P0 | Identify cross-border transfer scenarios and select the compliance route |
| P1 | Carry out a PIA (China) and a DPIA (EU) |
| P1 | Sign the SCCs and carry out a TIA |
| P2 | Deploy jurisdiction-specific data storage and model nodes |
| P2 | Establish channels for the exercise of data subject rights |
| Ongoing | Monitor regulatory change in both jurisdictions |
Frequently asked questions
Q: We have only a small number of users in Europe. Do we need GDPR compliance? A: Yes. The GDPR applies to every undertaking processing the data of EU users, irrespective of size. Obligations such as the DPIA are triggered only where the processing is high-risk.
Q: Can the PIPL and GDPR privacy policies be combined? A: It is not advisable. The two regimes differ substantially on localisation, separate consent and transfer mechanisms, and a combined document may render the company non-compliant in one jurisdiction. A jurisdiction-specific approach is preferable.
Q: Our AI model is trained in China using EU user data. What is required? A: (1) The transfer from the EU to China requires SCCs and a TIA; (2) processing in China must comply with the PIPL; (3) where sensitive personal information or large-scale processing is involved, a DPIA in the EU and a PIA in China are required; (4) data subject rights must be protected in both jurisdictions.
Q: We have servers in China and store EU user data there. Is that a problem? A: There is a risk. The GDPR requires appropriate safeguards for transfers, namely SCCs with a TIA or an adequacy decision. China is not on the adequacy list, so the SCCs must be signed and a TIA carried out to assess whether Chinese law affects the SCC obligations.
This article is prepared on the basis of the Personal Information Protection Law (PIPL), the GDPR (Regulation (EU) 2016/679) and the Cyberspace Administration’s policy questions and answers on data export of September 2026. For assistance with multi-jurisdiction compliance, please contact Geason Law Offices.