Transferring Personal Data from the EU to China: What Is Allowed

Does your European company work with a supplier, a subsidiary or a team in China? Or are you a Chinese company receiving data about European customers? In both cases the GDPR strictly regulates the transfer. Sila International Advisory, led by Younes (legal consultant specialising in GDPR and external DPO services), explains what is possible and how to do it properly.

Sending files, but also remote access from China: a support team viewing a customer database, developers logging into a server, a cloud tool administered from a Chinese site, a subsidiary reading the group CRM. In all these cases there is a transfer under the GDPR (EDPB Guidelines 05/2021).

The 2021 standard contractual clauses (Implementing Decision (EU) 2021/914) are the most common tool: a standard contract signed between the European exporter and the Chinese importer. Binding corporate rules (BCRs, Article 47) suit groups that transfer regularly within the group. The derogations in Article 49 (explicit consent, performance of a contract) are interpreted narrowly and are not meant for regular transfers.

Signing SCCs is not enough. Since Schrems II (CJEU, 16 July 2020), the exporter must assess whether the importing country's law and practice, in particular public authorities' access to data, allow the importer to comply with the clauses (SCC clauses 14 and 15). This assessment must be documented. If risks remain, supplementary measures are needed (encryption with keys kept in the EU, pseudonymisation: EDPB Recommendations 01/2020). If no measure is sufficient, the transfer should not take place.

Chinese PIPL also regulates data leaving China: a security assessment by the Chinese authority (CAC), a Chinese standard contract filed with the authority, or certification. According to law firm analyses, the standard contract and its impact assessment must be filed within ten working days of the contract taking effect (the applicable thresholds and exemptions depend on the volume and nature of the data). A two-way flow can therefore require two sets of clauses.

Is there an adequacy decision for China?

Not at the time of writing (see the Commission's list of adequacy decisions). Appropriate safeguards such as SCCs are therefore required.

Is remote access from China a transfer?

Yes. A person in China viewing data stored in the EU carries out a transfer under the GDPR.

Is individuals' consent enough?

Rarely. The explicit consent derogation is applied restrictively and does not suit regular transfers.

Are SCCs enough for China?

No. They must be completed by a transfer impact assessment and, where needed, additional technical measures.

Must customers be told about the transfer to China?

Yes. Your privacy notice must mention the transfer, the country and the safeguard used (Article 13).