GDPR vs PIPL

Doing business with China means complying with two privacy laws.

The EU's GDPR and China's Personal Information Protection Law (PIPL) use similar words, but they come from different philosophies and sometimes impose incompatible obligations. For any company that sells, manufactures, invests or sources in China, or serves European customers from China, getting it wrong can mean fines of up to 4% of worldwide turnover in Europe and 5% in China, plus personal liability for managers.

GDPR vs PIPL is the practical guide that compares the two laws from a business perspective: clear, rigorous and organised around real situations.

Inside the book:

• a topic-by-topic comparison: scope, legal bases, separate consent, sensitive personal information, individuals' rights, controllers and personal information handlers, security and penalties;
• cross-border data transfers in both directions: standard contractual clauses and transfer impact assessments, the CAC standard contract and security assessment, the 2024 exemptions and thresholds;
• data localisation, important data and conflicts between the two laws, including requests from foreign authorities;
• nine business situations: B2B and B2C sales, marketplaces, subsidiaries and joint ventures, HR, Chinese companies selling in Europe, acquisitions, suppliers and cloud, Chinese artificial intelligence;
• a map of the wider framework: EU AI Act, Data Act, NIS2, China's Data Security Law and rules on algorithms and generative AI;
• a comparative table, an English-Chinese glossary, a chronology of the legislation and official sources.