PIPL vs GDPR: Build one operating model without confusing two legal regimes

PIPL can apply to processing in mainland China and specified processing outside China concerning people in mainland China.

GDPR can apply through an EU or EEA establishment and through specified targeting or monitoring from outside the region.

Maintain two scope fields in the inventory and preserve the factual basis for each conclusion.

Map personal-information handlers, entrusted processing and China-connected systems.

Map controllers, joint controllers, processors and EU-connected systems.

Use one system map, but attach regime-specific scope and role determinations.

Identify the personal-information handler that determines purposes and methods.

Identify the controller, and assess joint controllership where decisions are shared.

Record the factual decision rights first, then assign the appropriate label under each regime.

Document entrusted processing, instructions, purpose, duration, method, categories, protection measures and supervision.

Document processor instructions and the required Article 28 terms; assess sub-processing.

Use a shared vendor schedule with separate PIPL and GDPR contract checkpoints.

PIPL provides specified processing grounds and does not contain a general legitimate-interests basis equivalent to GDPR Article 6(1)(f).

GDPR Article 6 includes consent, contract, legal obligation, vital interests, public task and legitimate interests, subject to their conditions.

Give every processing purpose separate PIPL-basis and GDPR-basis fields. Never put “global lawful basis” in the register.

Specific situations may require separate consent, including defined sensitive-information, transfer or disclosure contexts.

Consent must meet GDPR conditions when relied on and is not automatically the best basis for employment or other imbalanced settings.

Design one consent ledger that identifies the regime, purpose, notice version, collection event and withdrawal effect.

Sensitive personal information is defined through risk of harm if leaked or misused and includes specified examples; special purpose, necessity and stricter safeguards matter.

Article 9 special-category data uses an enumerated-category model and requires both an Article 6 basis and an Article 9 condition where applicable.

Store dual classification flags, rationale, necessity, safeguards and the additional condition or consent record.

Apply PIPL rules for personal information of children under 14 and assess necessity, notice and safeguards for workforce processing.

Apply GDPR child-consent rules in the relevant context and scrutinise employment necessity, transparency and local member-state rules.

Branch age thresholds and HR legal analysis by geography; avoid a single global consent statement.

Support applicable PIPL rights and preserve the request, identity check, search and response record.

Support GDPR data-subject rights with the applicable timing, extension and exception logic.

Use one portal and case ID, then route to a jurisdiction-specific playbook and deadline clock.

Record the PIPL basis for fulfilment, limitation or refusal and the handler responsible.

Record the GDPR right invoked, search scope, exemptions and controller response.

Keep a shared evidence envelope with separate legal-decision fields and approved response templates.

Assess the applicable China route, which may involve a security assessment, China standard contract or certification, together with notice, consent and impact-assessment requirements where applicable.

Assess GDPR Chapter V: adequacy or an appropriate safeguard such as EU SCCs, plus supplementary analysis where required.

Create linked China-outbound and EU-outbound transfer files for the same technical flow.

Executing EU SCCs does not by itself satisfy the applicable China export route.

Executing the China standard contract does not by itself satisfy GDPR Chapter V.

Gate production transfer on completion of both applicable files.

Apply measures appropriate to processing risk and PIPL duties, with heightened controls for sensitive information and entrusted processing.

Apply Article 32 risk-based technical and organisational measures and document controller-processor responsibilities.

Maintain one control catalogue mapped separately to PIPL and GDPR obligations.

Assess PIPL remedial and notification duties using China-side facts and current regulator practice.

Run GDPR supervisory-authority and individual notification tests, including the 72-hour authority-notification clock where applicable.

Use one incident bridge with two decision logs, owners and clocks; do not wait for one regime before starting the other.

An offshore handler within PIPL extraterritorial scope may need a dedicated entity or representative in mainland China and related filings.

A non-EU controller or processor within Article 3(2) may need an Article 27 representative, subject to the provision and its exceptions.

Track each appointment trigger, mandate, contact publication and regulator-facing obligation independently.

Assess the PIPL personal-information protection responsible-person trigger and publish or report required contact details as applicable.

Assess GDPR DPO appointment under Articles 37–39 and protect independence, access and resources.

One individual may coordinate globally, but the register must show which statutory role is held, for which entity and why.

Maintain a China-side processing inventory that supports transparency, basis, sensitive-information, sharing, entrustment, retention and transfer analysis.

Maintain applicable Article 30 records and related controller or processor evidence.

Choose two linked registers or one master register with mandatory regime-specific fields; never overwrite one conclusion with the other.

Conduct and retain the required personal-information protection impact assessment for specified high-risk activities.

Conduct a DPIA where processing is likely to result in high risk and meet consultation duties where applicable.

Use one factual risk assessment workbook with separate legal thresholds, conclusions, approvals and retention rules.

Classify employee fields under PIPL, identify the processing ground, issue the China notice and restrict sensitive fields and access.

Classify GDPR personal and special-category data, identify Article 6 and any Article 9 conditions, and issue the relevant privacy information.

Build a field-level map showing purpose, viewers, hosting, retention, basis and classification under both regimes.

Assess China export, entrusted-processing, separate-consent and impact-assessment requirements for the actual architecture.

Assess controller-processor terms, sub-processors, Chapter V transfer mechanism and transfer-risk controls.

Release the HRIS only after the China transfer file, GDPR transfer file, notices, vendor schedules, rights branch and incident branch are approved.

Reassess when purposes, sensitive fields, recipients, offshore access, volumes or China-facing entities change.

Reassess when purposes, categories, recipients, risk, international transfers or establishment and targeting facts change.

Connect procurement, product, HR and security change tickets to the privacy register.

Monitor PIPL implementation measures, CAC transfer rules and enforcement developments.

Monitor EU and member-state law, regulator guidance, adequacy and transfer developments.

Assign owners and review dates; preserve the version of the source and conclusion used at approval.

Retain the China scope, basis, notice, consent, contract, assessment, security, rights and transfer evidence that supports the decision.

Retain the GDPR scope, roles, basis, transparency, contracts, records, DPIA, rights, security and transfer evidence.

Link every conclusion to an owner, date, facts, source, approver and change trigger.

Send the China entity and data-flow map, volumes, fields, recipients, purposes, notices, contracts and current China transfer materials.

Send the EU entity and role map, establishments or targeting facts, purposes, bases, recipients, safeguards and current transfer materials.

Send one factual pack plus a question list identifying which PIPL and GDPR decisions remain open.