EU General Data Protection Regulation (GDPR)

A controller or processor that is caught by Art. 3(2) but not established in the EU must designate an EU representative in writing, established in one of the Member States where the relevant data subjects are. The representative must be mandated to be addressed, in addition to or instead of the controller or processor, by supervisory authorities and data subjects on all processing-related issues. The only exemptions are processing that is occasional, does not include large-scale processing of Art. 9(1) special categories or Art. 10 criminal-conviction data, and is unlikely to result in a risk to natural persons; and public authorities.

Applies when

Companies established in China offering apps, SaaS or APIs to EU users or monitoring their behaviour. The exemption is narrow: processing is not "occasional" once a product is continuously operated for EU users.

Evidence to retain

• · Written mandate appointing the EU representative
• · Screenshot of the representative’s name, address and contact details published in the privacy notice
• · Copy of the records of processing activities held by the representative
• · Log of data subject requests and regulator correspondence forwarded by the representative

Estimated first-time effort: 3–10 person-days (estimate, not a commitment)

A DPO must be designated in three cases: processing carried out by a public authority or body, except courts acting judicially; where the core activities of the controller or processor consist of processing operations that, by their nature, scope or purposes, require regular and systematic monitoring of data subjects on a large scale; or where the core activities consist of large-scale processing of Art. 9 special categories or Art. 10 criminal-conviction data. The DPO must be designated on the basis of professional qualities, in particular expert knowledge of data protection law and practice, and may be a staff member or fulfil the tasks under a service contract. A group of undertakings may appoint a single DPO provided the DPO is easily accessible from each establishment.

Applies when

Typical triggers: consumer recommendation or profiling products, adtech, wearables and connected-vehicle data platforms (regular and systematic monitoring on a large scale); healthcare AI, biometric and emotion-recognition products (large-scale special categories). Pure B2B tooling with no exposure to end-user behavioural data usually does not trigger it.

Evidence to retain

• · DPO designation decision and evidence of professional qualifications
• · Published DPO contact details and the notification filed with the supervisory authority
• · Documentation safeguarding independence (no instructions, no dismissal for performing the role, direct reporting to highest management)
• · DPO annual activity report and record of advice given

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

Controllers and their representatives must maintain records of processing activities under their responsibility, containing at least the name and contact details of the controller, joint controllers, representative and DPO; the purposes of processing; the categories of data subjects and of personal data; the categories of recipients including recipients in third countries; identification of third countries and the safeguards used for transfers; the envisaged erasure time limits for each category; and a general description of the Art. 32(1) technical and organisational security measures. The Art. 30(5) exemption for organisations with fewer than 250 employees is very narrow: it does not apply where the processing is likely to result in a risk to data subjects’ rights and freedoms, is not occasional, or involves special categories or criminal-conviction data.

Applies when

Almost every Chinese AI company processing personal data for the EU. In practice this is the first document a supervisory authority requests and a standard item in EU customer due diligence. AI companies should list "model training" as a distinct processing activity, stating the data sources, legal basis and erasure mechanism.

Evidence to retain

• · Controller records covering all Art. 30(1) elements
• · Processor records covering the Art. 30(2) elements where acting as a processor
• · Separate record entries for model training, fine-tuning and evaluation activities
• · Signed periodic review and update records

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Each processing activity, including training or fine-tuning models on user data, must have a documented Art. 6 lawful basis; processing of Art. 9(1) special categories additionally requires an Art. 9(2) exception. Where consent is relied on, it must meet the Art. 4(11) and Art. 7 requirements of being freely given, specific, informed and unambiguous, withdrawable at any time and as easily as it was given. Where legitimate interests are relied on, a three-part balancing test must be performed and retained. Information to data subjects must cover all Art. 13 and 14 elements, and Art. 14(3) requires notice within a reasonable period and at the latest within one month where data was not obtained from the data subject.

Applies when

For AI companies the key move is to separate "improving models with production user data" from "providing the service" as two processing activities, each with its own basis. Scraping public web pages for training is indirect collection, so the Art. 14 notice duty and the Art. 14(5)(b) disproportionate-effort exception must be assessed and documented case by case.

Evidence to retain

• · Lawful basis register organised by processing activity
• · Legitimate interests assessment (LIA) documents
• · Screenshots of consent capture interfaces and consent and withdrawal logs
• · Version history of the privacy notice and layered notices

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Build a demonstrable process covering access, rectification, erasure, restriction, portability, objection and rights relating to automated decision-making. Under Art. 12(3), the controller must inform the data subject of the action taken without undue delay and in any event within one month of receipt, extendable by two further months for complex or numerous requests provided the data subject is informed of the extension and the reasons within the first month. Responses are free of charge except for manifestly unfounded or excessive requests. For AI companies the hard part is locating and acting on personal data that has entered training sets and vector indexes, and explaining whether it remains reproducible in model outputs.

Applies when

Chinese AI companies operating products for EU users. The real pain points are deleting personal data from vector databases and retrieval-augmented corpora, residues in logs and caches, and the processor’s duty to assist the controller under Art. 28(3)(e).

Deadline: Reply within one month of receipt; extendable by two months for complex cases if notified within the first month.

Evidence to retain

• · Data subject request SOP and a deadline-tracking dashboard
• · Complete case files covering intake, identity verification, action and reply
• · Cross-system data location inventory covering training sets, vector indexes, logs and backups
• · Sample extension notices and the related statistics

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Where a type of processing, in particular using new technologies and taking account of its nature, scope, context and purposes, is likely to result in a high risk to natural persons’ rights and freedoms, the controller must carry out a DPIA before processing. Art. 35(3) lists three mandatory cases: systematic and extensive evaluation of personal aspects based on automated processing, including profiling, on which decisions producing legal or similarly significant effects are based; large-scale processing of Art. 9(1) special categories or Art. 10 criminal-conviction data; and systematic monitoring of a publicly accessible area on a large scale. The DPO’s advice must be sought where one is designated. Where the DPIA indicates a high residual risk absent mitigation, the supervisory authority must be consulted before processing (Art. 36).

Applies when

Frequent triggers for Chinese AI companies: face or voiceprint recognition and access control, video analytics in public spaces, recruitment and performance scoring, credit and insurance underwriting, inference of health or mental state, and profiling-based recommendation aimed at minors. The DPIA and the AI Act Art. 27 FRIA may be cross-referenced, which the AI Omnibus now expressly allows.

Deadline: Completed before processing begins; where Art. 36 applies, consultation must conclude before processing starts.

Evidence to retain

• · DPIA report covering the description of processing, necessity and proportionality, risk assessment and mitigation measures
• · Record of the DPO’s advice
• · Record of views sought from data subjects or their representatives where applicable
• · Correspondence on prior consultation with the supervisory authority where Art. 36 is triggered

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

A data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them. Only three exceptions apply: the decision is necessary for entering into or performing a contract between the data subject and the controller; it is authorised by Union or Member State law laying down suitable safeguards; or it is based on the data subject’s explicit consent. In the contract-necessity and explicit-consent cases the controller must implement suitable safeguards including, at least, the right to obtain human intervention, to express a point of view and to contest the decision. Such decisions must not be based on Art. 9(1) special categories unless Art. 9(2)(a) or (g) applies with suitable safeguards in place.

Applies when

This hits AI decisioning products directly: automated credit approval and limit changes, automated fraud declines, automated CV screening and rejection, automated insurance pricing and refusal, and automated account bans on content platforms. Chinese vendors exporting such capabilities must build a human-review path into the product, not merely promise an appeal route in the contract.

Evidence to retain

• · Inventory of solely automated decision use cases with the legal basis determination
• · Product description and operational logs of the human-intervention path
• · Explanation of the decision logic in a form intelligible to data subjects
• · Statistics on contested decisions and overturn rates

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

On a personal data breach the controller must notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to natural persons’ rights and freedoms; a notification made later must be accompanied by reasons for the delay. The notification must at least describe the nature of the breach including the categories and approximate numbers of data subjects and records concerned, give the DPO or other contact point, describe the likely consequences, and describe measures taken or proposed. Information may be provided in phases. A processor must notify the controller without undue delay after becoming aware. Where the breach is likely to result in a high risk, the controller must also communicate it to the data subjects without undue delay in clear and plain language. The controller must document all breaches, their effects and the remedial action taken, so the authority can verify compliance.

Applies when

All Chinese AI companies processing EU personal data. Time zones are the main practical obstacle: the 72 hours run from awareness, so incidents detected overnight in China need an on-call triage and escalation path, otherwise the clock is consumed during assessment.

Deadline: Notify the supervisory authority within 72 hours of awareness; communicate to data subjects without undue delay where the risk is high.

Evidence to retain

• · Breach response plan breaking the 72-hour clock into tasks with named owners
• · Breach register covering all incidents, including the reasoning where notification was not required
• · Notification filed with the supervisory authority and the acknowledgement
• · Communication text and delivery records for data subjects where applicable

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

A controller may only use processors providing sufficient guarantees to implement appropriate technical and organisational measures, and the processing must be governed by a contract or other binding legal act setting out the subject matter, duration, nature and purpose of processing, the types of personal data and categories of data subjects, and the controller’s rights and obligations. A processor must not engage another processor without prior specific or general written authorisation from the controller; under a general authorisation the processor must inform the controller of intended additions or replacements, giving it the opportunity to object.

Applies when

When a Chinese AI company acts as processor for EU customers it must sign an Art. 28-compliant data processing agreement and disclose the sub-processor chain truthfully, including affiliates and cloud providers in China; that disclosure usually triggers the customer’s transfer assessment.

Evidence to retain

• · Repository of executed data processing agreements
• · Sub-processor list and records of change notifications
• · Due diligence and security assessment records for sub-processors
• · Operating arrangements by which the processor assists the controller with Arts. 32 to 36

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

Controllers and processors must implement appropriate technical and organisational measures ensuring a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of processing, and the risks to natural persons. Measures may include pseudonymisation and encryption; the ability to ensure ongoing confidentiality, integrity, availability and resilience of processing systems and services; the ability to restore availability and access in a timely manner after an incident; and a process for regularly testing, assessing and evaluating effectiveness. Data protection by design and by default must also be implemented at the time of determining the means of processing and during the processing itself (Art. 25).

Applies when

Concrete requirements in AI settings: access control and encryption for training data and model weights, minimisation and masking of personal data in inference logs, retention policy for prompts and outputs, and security controls at suppliers such as GPU clouds and annotation vendors.

Evidence to retain

• · Inventory of security measures with the risk-proportionality rationale
• · Evidence of encryption and pseudonymisation implementation, including key management and masking rules
• · Business continuity and restoration drill records
• · Periodic effectiveness testing and assessment reports such as penetration tests and access reviews

Estimated first-time effort: 15–40 person-days (estimate, not a commitment)

Transfers of personal data to a third country or international organisation are permitted only under Chapter V: an adequacy decision of the Commission (Art. 45); appropriate safeguards (Art. 46, including Commission-adopted standard data protection clauses, binding corporate rules, approved codes of conduct or certification mechanisms, together with enforceable data subject rights and effective remedies); or the Art. 49 derogations for specific situations. China is not covered by an EU adequacy decision, so the default route for Chinese AI companies is to execute standard contractual clauses and complete a transfer impact assessment identifying how the destination country’s law affects the effectiveness of those clauses, and to adopt supplementary measures.

Applies when

Concrete triggers: sending EU user data back to China for model training or human annotation; China-based engineering teams remotely accessing EU production databases; and hosting EU customer data on cloud or support systems located in China. Note that remote access itself constitutes a transfer.

Evidence to retain

• · Executed standard contractual clauses, including the module selection and annexes
• · Transfer impact assessment report and the list of supplementary measures
• · Data flow maps and a transfer inventory covering remote-access accounts
• · Policy and transparency records for handling government access requests

Estimated first-time effort: 10–30 person-days (estimate, not a commitment)