GDPR

Introduction to GDPR

1. What Is the GDPR?

The GDPR – General Data Protection Regulation – is the EU data protection law adopted in April 2016 and in force since 25 May 2018, officially Regulation (EU) 2016/679.

The GDPR replaced the 1995 Data Protection Directive (95/46/EC) and is today the world’s most influential data protection law, often called “the gold standard of data protection”. Data protection laws in many countries (including China’s Personal Information Protection Law, Brazil’s LGPD and California’s CPRA) are modeled on it.

Core objectives:

• Protect the personal data and privacy of natural persons

• Harmonize data protection rules across EU Member States

• Strengthen data subjects’ control

• Increase corporate accountability and transparency

2. Scope

Territorial scope (extraterritorial effect)

The GDPR applies well beyond EU territory:

1. Organizations established in the EU: wherever the processing takes place, as long as the organization has an establishment in the EU.

2. Organizations outside the EU – the GDPR applies if either of the following is met:

• Offering goods or services to people in the EU (whether paid or free)

• Monitoring the behavior of people in the EU (e.g. website tracking, targeted advertising)

What this means for Chinese companies: if you have EU users, customers or employees, or your website targets the EU market, you are directly subject to the GDPR even if you operate in China.

Who it applies to

Role	Definition	Responsibility
Data controller	The entity that determines the purposes and means of processing	Primary responsibility
Data processor	Processes data on behalf of the controller	Supporting responsibility
Data subject	The individual to whom the personal data relate	Rights holder

3. Core Concepts

What is “personal data”?

Any information relating to an identifiable natural person is personal data, including:

• Direct identifiers: name, ID number, passport number

• Contact information: phone, email, address

• Online identifiers: IP addresses, cookie IDs, device IDs, usernames

• Location data: GPS, location records

• Biometrics: fingerprints, faces, irises

• Financial information: accounts, purchase records

• Health data

• Behavioral data: browsing history, click records

Special categories of data (sensitive data)

Article 9 GDPR gives strict protection to the following data, which in principle may not be processed:

• Racial or ethnic origin

• Political opinions

• Religious or philosophical beliefs

• Trade union membership

• Genetic data

• Biometric data

• Health data

• Sex life or sexual orientation

Processing is permitted only with explicit consent or under statutory exceptions.

4. The Seven Principles (Article 5 GDPR)

Principle	Meaning
1. Lawfulness, fairness and transparency	Processing must have a legal basis, be fair and be transparent to the data subject
2. Purpose limitation	Data may only be used for specified, explicit and legitimate purposes
3. Data minimization	Collect only necessary data – no “collect first, decide later”
4. Accuracy	Keep data accurate and up to date; inaccurate data must be corrected
5. Storage limitation	Data must be deleted or anonymized once no longer necessary
6. Integrity and confidentiality	Appropriate security measures against leaks, loss and unauthorized access
7. Accountability	The controller must be able to demonstrate compliance with these principles – a defining feature of the GDPR

Key change: compared with earlier law, the GDPR emphasizes “being able to demonstrate compliance” – you must not only comply but also have documentation and evidence.

5. Six Lawful Bases for Processing (Article 6 GDPR)

Processing of personal data requires at least one of the following legal bases:

Basis	When it applies
Consent	Explicit consent from the user, which must be withdrawable
Contractual necessity	Performing a contract with the data subject (e.g. order delivery)
Legal obligation	Complying with legal requirements (e.g. tax records)
Vital interests	Protecting someone’s life
Public interest	Performing a public task
Legitimate interests	Legitimate interests of the controller or a third party, subject to a balancing test

Requirements for valid consent: it must be freely given, specific, informed and unambiguous – pre-ticked boxes, bundled consent and unfair terms are invalid.

6. The Eight Rights of Data Subjects

The GDPR gives data subjects strong control:

Right	Content	Response time
1. Right to be informed	To be told the purposes and means of processing at the time of collection	Immediately
2. Right of access	To obtain a copy of the data being processed	1 month
3. Right to rectification	To have inaccurate data corrected	1 month
4. Right to erasure / right to be forgotten	To have data deleted in certain circumstances	1 month
5. Right to restriction of processing	To suspend processing	1 month
6. Right to data portability	To export and transfer data in a machine-readable format	1 month
7. Right to object	To object to processing based on legitimate interests or for direct marketing	Marketing stopped immediately
8. Right not to be subject to automated decision-making	To object to significant decisions made solely by automated means (e.g. AI scoring)	Immediately

Response requirements:

• Usually within 1 month

• Can be extended to 3 months in complex cases (with reasons)

• Free of charge in principle (manifestly unfounded or excessive requests may be charged or refused)

7. Core Obligations for Businesses

1. Privacy by Design & Default (Article 25)

• Build privacy protection in at the design stage

• Default settings should be the most privacy-friendly

• Examples: precise location off by default, minimal data collection by default, anonymization by default

2. Records of Processing Activities (ROPA, Article 30)

Mandatory for organizations with ≥250 employees or where processing is risky:

• Purposes and legal bases of processing

• Categories of data and of data subjects

• Recipients

• Cross-border transfers

• Retention periods

• Security measures

3. Data Protection Impact Assessment (DPIA, Article 35)

A DPIA is mandatory when:

• Systematic, large-scale processing of special categories of data

• Large-scale monitoring of publicly accessible areas

• Automated decision-making with legal or similarly significant effects on individuals

• Use of new technologies (AI, facial recognition, IoT, genetic testing)

4. Data Protection Officer (DPO, Articles 37–39)

A DPO must be appointed when:

• The organization is a public authority (except courts)

• Core activities involve large-scale, systematic monitoring of data subjects

• Core activities involve large-scale processing of special categories of data

DPO responsibilities: monitoring compliance, training staff, liaising with supervisory authorities, providing advice.

5. EU Representative (Article 27)

Controllers/processors outside the EU that are subject to the GDPR must appoint a representative in the EU:

• Acting as the point of contact for supervisory authorities and data subjects

• Usually a professional service company in the EU

• Exemption: occasional, non-large-scale processing that does not involve special categories of data

For Chinese companies going global, this is practically mandatory.

6. Managing Processors (Article 28)

Controllers and processors must sign a Data Processing Agreement (DPA) specifying:

• The subject matter, duration, nature and purpose of processing

• Categories of data and data subjects

• The processor’s obligations (confidentiality, security, assistance, deletion/return)

• The controller’s audit rights

7. Data Breach Notification (Articles 33 and 34)

After a personal data breach:

• Notify the competent supervisory authority within 72 hours (unless the breach is unlikely to result in a risk to rights)

• In high-risk cases, also notify the data subjects

The notification must include the nature of the breach, its scope, likely consequences and the measures taken or proposed.

8. International Data Transfers (Chapter V)

Transfers of personal data outside the EU must use one of the following mechanisms:

Mechanism	Description
Adequacy decision	The EU has found the country’s level of protection adequate – currently including the UK, Switzerland, Japan, South Korea, Canada (commercial organizations), New Zealand, Argentina, Uruguay, Andorra, the Faroe Islands, Guernsey, the Isle of Man, Jersey, Israel and the US (DPF framework, 2023)
Standard Contractual Clauses (SCCs)	New 2021 templates, signed between companies
Binding Corporate Rules (BCRs)	Approved internal rules for multinational groups
Certification or codes of conduct	Approved certification mechanisms
Derogations for specific situations	Explicit consent, contractual necessity, legal claims, etc.

Important: China is not on the list of adequate countries. Transfers of data from the EU to China must use mechanisms such as SCCs, and since the Schrems II judgment (2020) a Transfer Impact Assessment (TIA) is required to assess the impact of the recipient country’s laws on the rights of EU data subjects.

8. Penalties

The GDPR carries some of the heaviest fines in the world for data protection:

Type of infringement	Maximum fine
Less serious infringements	€10,000,000 or 2% of global annual turnover (whichever is higher)
Serious infringements	€20,000,000 or 4% of global annual turnover (whichever is higher)

Less serious vs. serious infringements:

• Less serious: missing ROPA, no DPIA, no DPO appointed, non-compliant data processing agreements, etc.

• Serious: violating the basic principles, data subject rights, international transfer rules or consent requirements, etc.

Major fines

Year	Company	Fine	Reason
2023	Meta (Facebook)	€1.2 billion	International data transfers (violation after Schrems II)
2021	Amazon	€746 million	Consent mechanism issues
2024	Uber	€290 million	Transfer of driver data to the US
2023	TikTok	€345 million	Insufficient protection of children’s data
2023	Criteo	€40 million	Consent management violations
2019	Google	€50 million	Transparency and consent issues

9. Supervisory Authorities

National data protection authorities (DPAs)

Each EU Member State has an independent DPA. Well-known authorities include:

• CNIL (France) – very active in enforcement

• ICO (UK – still enforces the UK GDPR after Brexit)

• DPC (Ireland) – supervises most US tech giants

• BfDI (German federal) + state DPAs

• AEPD (Spain) – the highest number of penalty cases

• Garante (Italy) – active in AI regulation

European Data Protection Board (EDPB)

• Composed of the DPAs of the Member States

• Issues guidelines and opinions for a consistent EU interpretation

• Resolves cross-border disputes

• Leads discussions on new legislation

The “One-Stop-Shop” mechanism

For cross-border processing, the DPA of the country of the company’s main establishment acts as the lead supervisory authority, with other DPAs cooperating. This is an important GDPR design feature that simplifies compliance.

10. Comparison with Other Major Data Protection Laws

Dimension	GDPR	China PIPL	California CPRA
Effective date	2018.5.25	2021.11.1	1 January 2023 (amending the CCPA)
Extraterritorial effect	Yes	Yes	Yes
Number of legal bases	6	7 (no “legitimate interests”)	Similar but simplified
Consent requirements	Strict	Stricter (separate consent for sensitive information)	More relaxed (collection by default, users can opt out)
Data subject rights	8	Similar + Chinese specifics	5 + opt-out of sale
International transfers	SCCs / BCRs / adequacy	Security assessment / standard contract / certification	Fewer restrictions
DPO appointment	Mandatory in some cases	Mandatory in some cases	Not mandatory
Breach notification	72 hours	Immediately (no specific deadline)	Depends on the case
Maximum fine	€20M / 4% of global turnover	RMB 50 million / 5% of annual turnover	USD $7,500 per violation

11. Practical Impact on Chinese Companies

Who is subject to the GDPR?

Almost every company going global:

• Cross-border e-commerce (selling to EU consumers)

• Apps / games launched overseas

• SaaS and cloud services (EU customers)

• Smart hardware / IoT (EU users)

• Cross-border logistics and payments

• Contract manufacturers (acting as processors when handling EU brands’ data)

• HR / recruitment (EU employees/applicants)

Risks of non-compliance

1. Huge fines – up to 4% of annual turnover

2. Lawsuits by EU users – collective actions increasingly common

3. Business disruption – authorities can order processing or transfers to stop

4. Damage to brand reputation

5. Partners refusing to work with you – EU B2B customers strictly vet suppliers’ compliance

Minimum compliance checklist

Appoint an EU Representative Prepare a GDPR-compliant privacy policy (multilingual)
Deploy a cookie consent management platform (CMP)
Establish a mechanism for responding to data subject rights requests
Sign the 2021 SCCs + complete a TIA Establish a data breach response plan (72-hour notification)
Sign DPAs (data processing agreements) with processors Appoint a DPO (where applicable)
Staff GDPR training Establish a ROPA (records of processing activities)

12. GDPR Timeline and Outlook

Date	Milestone
1995	EU Data Protection Directive 95/46/EC
April 2016	GDPR adopted
25 May 2018	GDPR applies (end of the 2-year transition period)
July 2020	Schrems II judgment – Privacy Shield invalidated
June 2021	New SCCs published
July 2023	EU-US Data Privacy Framework (DPF) takes effect – replacing Privacy Shield
August 2024	EU AI Act enters into force – working alongside the GDPR
From 2025	Data Act, Data Governance Act, DSA, DMA and other related regulations progressively apply
Ongoing	EDPB guidelines continually updated; enforcement intensifying

Future trends

• Overlapping AI and GDPR regulation – data governance for generative AI under the AI Act

• Tackling consent fatigue – the EU is discussing simplifying cookie consent

• Stronger protection of children’s data – led by large fines such as TikTok’s

• Increasingly strict enforcement – individual fines continue to rise

• Adequacy assessments of third countries – the list is adjusted dynamically