How does China’s new Personal Information Protection Law (PIPL) compare to the European Union’s GDPR? In this post, I provide a quick PIPL vs. GDPR comparison. In comparing the PIPL with the GDPR, I will note a few key similarities and differences — my comparison is not comprehensive.
Comparing PIPL and GDPR: Similarities
A few notable similarities between the PIPL and GDPR include:
- Both the PIPL and GDPR are extraterritorial.
- The PIPL and GDPR define personal data as involving identified and identifiable natural persons.
- The PIPL uses the GDPR’s lawful basis approach to data processing. Many other Asian privacy laws use the consent-based approach or an approach akin to the US approach of notice-and-choice.
- Both the PIPL and GDPR have special protections for sensitive data, but they differ on the types of data they recognize as sensitive.
- Both the PIPL and GDPR have a data breach notification requirement.
- The PIPL and GDPR recognize many of the same rights.
- Both the PIPL and GDPR require workforce training.
- Under certain circumstances, both the PIPL and GDPR require DPOs.
- Both the PIPL and GDPR require data protection impact assessments (DPIAs) in certain situations.
Comparing PIPL and GDPR: Differences
A few notable differences between the PIPL and GDPR include: