Cross-Border Data Transfer
China and the EU both regulate transfers, and the two regimes are not translations of each other. The work is finding where they diverge on the same data flow — and building one architecture that satisfies both.
Two regimes, one data flow, and no shared answer sheet
A company with EU customers and Chinese operations runs the same request through both systems. China’s Personal Information Protection Law and the GDPR govern that flow concurrently, but they were built on different logics: one starts from territorial and personal jurisdiction with a state-supervised export mechanism, the other from establishment and targeting with a transfer-instrument model. A document drafted for one does not satisfy the other, and translating it satisfies neither.
The practical consequence is that compliance has to be designed at the level of the data flow, not the document. Where the two regimes coincide, one control satisfies both. Where they diverge, the divergence has to be identified before the architecture is fixed — afterwards the cost is re-engineering.
What we do
- Data flow mapping: every China-EU flow, with source, destination, intermediate nodes and legal basis per hop
- Dual-track assessment: PIPL export mechanism selection against GDPR transfer instrument, and the points where both attach to one flow
- Mechanism execution: security assessment, certification or standard contract filing on the China side; SCCs, BCRs or adequacy on the EU side
- Transfer impact assessment: required in practice post-Schrems II, and the step most often skipped
- Documentation set: DPAs, SCC schedules, assessment reports, and records of processing
- Ongoing governance: re-assessment on flow changes, annual review, regulatory tracking
Seven points where the regimes diverge
| Dimension | China (PIPL) | EU (GDPR) |
|---|---|---|
| Jurisdictional basis | Territorial and personal; extraterritorial where processing targets people in China | Establishment, plus targeting of individuals in the EU |
| Export route | One of three mechanisms: security assessment, certification, or standard contract | Adequacy decision, appropriate safeguards, or derogation |
| Consent | Separate consent required for export of personal information | Transfer is not grounded in consent as a general route; consent is a narrow derogation |
| Localisation | Required for critical information infrastructure operators and over-threshold volume | No general localisation mandate |
| DPO | No mandatory DPO; a designated person required above volume thresholds | DPO mandatory in specified cases |
| Impact assessment | Required in defined circumstances, with limited prescriptive guidance | DPIA mandatory for enumerated categories |
| Penalty ceiling | Up to RMB 50 million or 5% of prior-year turnover | Up to EUR 20 million or 4% of global turnover |
What is different for an AI company
- Classify before choosing an export path. Security assessment, standard contract and certification apply on different conditions; establish data volume, sensitivity and recipient first.
- The EU side also needs a transfer impact assessment. Beyond SCCs, the recipient country’s legal environment and government access risk must be assessed separately, or the transfer itself is questionable.
- Training-data export is easily missed. Sending domestic user data abroad for training is providing personal information; de-identification does not automatically remove the obligation.
- Remote access counts as export. An overseas team accessing a domestic database over VPN is treated as an export in practice.
- Employee data needs its own review. HR systems, global payroll and performance data are routinely missed in compliance inventories.
Typical situations
Situation 1: An SCC was signed and treated as global compliance
The EU standard contractual clauses are executed, the transfer is documented on the EU side, and the China side is assumed to follow. It does not: the PIPL standard contract is a separate instrument with its own content and its own filing step, and an SCC satisfies neither requirement. Two filings, two documents, one data flow.
Our approach: treat the two as parallel obligations with a shared factual base. The data inventory, security measures and recipient description are written once and used in both filings, which shortens both and keeps them consistent.
Situation 2: Thresholds crossed without anyone noticing
Export assessment is not required for every transfer — it attaches above defined volume and sensitivity thresholds, or where the exporter is a critical information infrastructure operator. In an aggregated-API architecture, request volume accumulates across customers and crosses the threshold before anyone treats it as a compliance event.
Our approach: instrument the counter, not the intention. Establish a live measure of export volume by category, assign a trigger point below the legal threshold, and treat crossing it as a scheduled work item rather than a discovery.
Situation 3: Transfer impact assessment skipped because the SCC looked sufficient
Post-Schrems II, using SCCs requires an assessment of the legal environment in the destination country and, where necessary, supplementary measures. Whether China provides an adequate level of protection is the question most often avoided — and it cannot be avoided, because the assessment is what the transfer instrument depends on.
Our approach: run the assessment explicitly, document the conclusion either way, and where the conclusion is unfavourable, add the supplementary measures — encryption, pseudonymisation, split processing — that make the transfer defensible in practice rather than on paper.
Process and deliverables
| Stage | Work | Deliverables |
|---|---|---|
| 1 | Data flow mapping and categorisation | Transfer map + legal basis per flow |
| 2 | Dual-track assessment and gap analysis | Divergence register + mechanism selection |
| 3 | Documentation and filings | DPA set, standard contract or assessment pack, TIA |
| 4 | Rights and governance build | Rights response procedure + governance calendar |
| Ongoing | Re-assessment on change, annual review | Updated filings + change log |
AI-specific deliverables
- Training-data transfer assessment: training corpora and user input assessed separately, with a route and document set for each.
- Remote-access transfer inventory: scenarios in which overseas teams access domestic systems, with the corresponding treatment.
Frequently asked
Does a GDPR-compliant transfer architecture satisfy the PIPL? No. The mechanisms are institutionally different: one is a supervisory assessment or filing regime, the other a contractual or adequacy regime. They can run in parallel on one architecture, and that is usually the efficient answer, but neither substitutes for the other.
When is the security assessment required rather than the standard contract? Depends on the exporter’s status and the volume and sensitivity of what is transferred. The 2024 provisions raised thresholds and introduced exemptions, so the first step is measurement rather than assumption — the applicable mechanism follows from the numbers.
Is consent a workable route? On the China side it is a required element for export, not an alternative to the mechanism. On the EU side consent is a narrow derogation unsuitable for repetitive transfers. Relying on consent to solve the architecture problem generally fails on both sides at once.
How often should the assessment be refreshed? On any material change to the flow, the recipient, the data categories or the destination legal environment, and at minimum annually. Assessments that are never refreshed describe a system that no longer exists.
Does training a model abroad count as a transfer? Yes, if training data or user input leaves China. Corpora and input are assessed separately, and remote access by an overseas team is a transfer even without a file being exported.
Legal basis
- Personal Information Protection Law: cross-border provision (Art. 38), separate consent (Art. 39), critical information infrastructure and volume-based localisation (Art. 40), impact assessment (Arts. 55-56)
- Provisions on Promoting and Regulating Cross-Border Data Flows (2024): thresholds and exemptions
- Measures for Security Assessment of Data Export and Measures for the Standard Contract for Export of Personal Information: procedure and filing
- GDPR: territorial scope (Art. 3), transfers (Chapter V), SCCs and BCRs, DPIA (Art. 35), DPO (Art. 37)
- Schrems II (CJEU C-311/18): transfer impact assessment and supplementary measures