Home › Compare laws side by side › PIPL vs EU GDPR
PIPL vs EU GDPR
Personal Information Protection Law of the People's Republic of China (China) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.
| Topic | PIPL China 13/14 facts confirmed by two sources | EU GDPR European Union (EEA) ✓ Confirmed by two sources |
|---|---|---|
| Status | In force since 1 Nov 2021. Key implementing rules: cross-border data flow provisions (22 Mar 2024), network data security regulations (1 Jan 2025), compliance audit measures (1 May 2025), certification measures (1 Jan 2026).✓ | In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓ |
| Who it applies to | Processing in mainland China, plus processing abroad of data of people in China to offer them products or services, or to analyse or evaluate their behaviour. Covers private and public sectors.✓ | Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓ |
| Size thresholds | No size threshold. Volume thresholds trigger extra duties: protection officer above 1 million individuals; mandatory audit every 2 years above 10 million; transfer mechanism tiers at 100,000 / 1 million (sensitive: 10,000).✓ | None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓ |
| Regulator | Cyberspace Administration of China (CAC), with the Ministry of Public Security, MIIT, SAMR and sector regulators✓ | National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓ |
| Breach or incident reporting | PIPL: act immediately and notify regulators and affected people (individual notice can be skipped if harm is effectively avoided, unless regulators order it). National Cybersecurity Incident Reporting Measures (from 1 Nov 2025), for incidents graded 'relatively major' or above: critical information infrastructure operators within 1 hour (to the CII protection department and public security), state organs within 2 hours (to their CAC office), other network operators within 4 hours (to the provincial CAC); summary report within 30 days after the incident is closed. | Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓ |
| Deadline to answer personal data requests | PIPL sets no fixed number of days: requests (access, copy, correct, delete, portability, explanation) must be handled in a timely manner, with reasons given for refusals.✓ | 1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓ |
| Data protection officer | Appoint a personal information protection officer if processing data of more than 1 million individuals; publish contact details and file them with the regulator.✓ | DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓ |
| Local representative | Overseas processors caught by the extraterritorial rule must set up a dedicated office or appoint a representative in China and file their details with the regulator (Art. 53).✓ | Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓ |
| Sending data abroad | Needs separate consent plus one route: CAC security assessment (CIIOs, important data, or >1m people / >10,000 sensitive since 1 Jan), or standard contract filing or certification (100,000-1m people / <10,000 sensitive). Exempt: <100,000 non-sensitive, contracts, HR, emergencies.✓ | Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓ |
| Cookies and consent | Consent is the main legal basis and must be informed and voluntary. Separate consent is needed for sensitive data, overseas transfers, sharing with another controller, and public disclosure.✓ | Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓ |
| Maximum penalty | Serious violations: up to RMB 50 million or 5% of the previous year's turnover, plus business suspension or licence revocation; responsible managers fined RMB 100,000-1 million and may be barred from senior roles.✓ | Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓ |
= confirmed by two independent sources, at least one official.
Facts marked “Being verified” are still being confirmed and are not given as answers.
Who each law applies to
- PIPL
- Processing in mainland China, plus processing abroad of data of people in China to offer them products or services, or to analyse or evaluate their behaviour. Covers private and public sectors.
- EU GDPR
- Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.
What you must do under PIPL
- Get consent (separate consent for sensitive data, sharing and overseas transfers) after a full notice
- Run a personal information impact assessment before sensitive, automated-decision or cross-border processing
- Pick the correct transfer route (assessment, standard contract or certification) based on yearly volumes
- Appoint a protection officer above 1 million individuals and file the contact details
- Audit compliance at least every 2 years if processing data of more than 10 million people
- Appoint a China representative if you serve Chinese users from abroad
What you must do under EU GDPR
- Identify a lawful basis for every processing purpose and record it.
- Publish a clear privacy notice covering purposes, recipients, retention and rights.
- Keep a record of processing activities and sign Art 28 contracts with processors.
- Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
- Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
- Answer access, erasure and other rights requests within one month.
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@