---
name: pipl-gdpr-crosswalk
description: "Compare China's Personal Information Protection Law (PIPL) with the EU GDPR for a specific data flow, and produce the gap list and cross-border transfer path for a company operating in both. Use when asked PIPL vs GDPR, 个人信息保护法和 GDPR 的区别, how do we transfer personal data out of China, our app serves users in China and Europe, or 数据出境 compliance. Produces a requirement crosswalk for the described processing, the transfer mechanism that likely applies in each direction, a prioritised gap list, and the questions to take to counsel. Not legal advice."
version: 1.0.0
---

# PIPL and GDPR Crosswalk

Companies serving users in both China and Europe face two strict regimes that look alike and differ in the details that matter: consent, sensitive data, and above all moving data across borders. This skill maps one described data flow against both, identifies the transfer path, and lists the gaps to close, so the conversation with counsel starts from specifics.

Part of the pm-chuhai bundle. For a general framework checklist, see `compliance-checklist`.

## What This Skill Produces

- **A crosswalk** for the described processing: each requirement under PIPL and GDPR, and what the company must do
- **The transfer path** in each direction (China to abroad, EU to China)
- **A gap list**, prioritised by risk
- **Questions for counsel**

## Required Inputs

Ask for these if not provided:
- **The data flow**: what personal information, about whom, collected where, stored where, accessed from where
- **Volumes**: roughly how many individuals per year, and whether any sensitive information is involved
- **The entities**: where the company and its processors are established
- **The purpose** of processing and the legal basis currently relied on

## Framework

Compare on these points. State each as a general description and mark it "verify current text", because implementing rules change.

| Point | PIPL (China) | GDPR (EU) |
|---|---|---|
| Legal bases | Consent and several other bases (contract, legal duty, emergencies, news reporting, public information, HR management); no general "legitimate interests" basis | Six bases, including legitimate interests |
| Separate consent | Required for sensitive information, transfers abroad, public disclosure, sharing with another handler, and some image or ID uses | Explicit consent for special categories when consent is the basis |
| Sensitive information | Broad, including financial accounts, location tracking, and all data of minors under 14 | Special categories (health, biometrics, beliefs and others) |
| Transfer abroad | One of: CAC security assessment, the standard contract, or certification, depending on volume and data type; a personal information protection impact assessment; separate consent. Exemptions introduced in 2024 for some lower-volume and necessary transfers: verify current thresholds | Adequacy decision, standard contractual clauses with a transfer impact assessment, binding corporate rules, or derogations |
| Local representative | Required for overseas handlers processing data of people in China in scope | Article 27 representative for non-EU controllers in scope |
| Data protection officer | Required above set volume thresholds | Required in defined cases |
| Breach notification | Promptly to the authority and individuals | Within 72 hours to the authority where required |

Then:
1. **Classify the flow**: which data, which direction, which volume band.
2. **Choose the transfer mechanism** for each direction and list its documents.
3. **List gaps**: what the company does today against what each regime requires.
4. **Prioritise** by likelihood of enforcement and harm: transfers and sensitive data first.

## Output Format

### PIPL and GDPR crosswalk: [company], [data flow]
**1. Flow summary** (data, people, locations, volume)
**2. Crosswalk** | Requirement | PIPL | GDPR | What we must do |
**3. Transfer path** | Direction | Mechanism | Documents | Verify |
**4. Gap list** | Gap | Regime | Priority | Fix |
**5. Questions for counsel**

End verbatim: *"This is a structured starting point, not legal advice. Data transfer rules in China and the EU change through implementing regulations; confirm every point with qualified counsel in both jurisdictions."*

## Quality Checks
- [ ] Every row that depends on thresholds or recent rules is marked "verify"
- [ ] The transfer mechanism is identified for each direction separately
- [ ] Sensitive information and minors' data are explicitly checked
- [ ] Gaps are prioritised with transfers and sensitive data first
- [ ] The disclaimer appears verbatim

## Anti-Patterns
- **Treating PIPL as "GDPR in China".** Legal bases and transfer rules differ materially.
- **Quoting volume thresholds as settled.** They have changed; verify.
- **Forgetting the EU to China direction.** It has its own requirements.
- **Giving a compliance verdict.** Map, prioritise and hand to counsel.

## Example Trigger Phrases
- "我们的 App 同时服务中国和欧洲用户，数据出境要怎么做？"
- "Compare PIPL and GDPR for our HR data flow from Shanghai to Dublin."
- "个人信息保护法和 GDPR 有什么关键区别？"
- "What do we need to transfer customer data out of China?"