1.1 欧盟《通用数据保护条例》（GDPR）制度要点/ Overview of the EU General Data Protection Regulation (GDPR)

欧盟自2018年5月25日起正式实施《通用数据保护条例》（General Data Protection Regulation，简称GDPR），是全球最具影响力、最具系统性的个人信息保护法之一，不仅适用于欧盟境内企业，还覆盖境外处理欧盟居民数据或监控其行为的实体（如海外电商向欧盟用户销售）。

The General Data Protection Regulation (GDPR)—enforced uniformly across the European Union (EU) since 25 May 2018—is widely recognized as the most rigorous and influential data protection regime globally. Its extraterritorial scope applies not only to entities established within the EU but also to non-EU organizations processing personal data of EU residents or monitoring their behaviour (e.g., offshore e-commerce platforms targeting EU consumers).

GDPR确立了个人数据处理的六大基本原则：合法性、公正性与透明性、目的限制、数据最小化、准确性、存储期限限制、完整性与保密性，并要求数据控制者在处理数据前即进行责任分配与风险预判。

The GDPR establishes six fundamental principles for personal data processing: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality. Data controllers shall allocate accountability and conduct pre-risk assessments prior to initiating processing activities.

GDPR赋予数据主体一系列权利，包括查阅、更正、删除、限制处理、反对处理、数据可携带及对自动化决策的反对权。其跨境数据传输规定要求，只有在目的地国家通过欧盟“充分性认定”（如日本），或通过标准合同条款（SCCs）、有约束力的公司规则（BCRs）等保障措施时，方可传输数据。企业需要遵守一系列合规义务，如进行数据保护影响评估（DPIA）、指定数据保护官（DPO）和记录处理活动。GDPR还要求在发生数据泄露时，企业必须在72小时内向监管机构报告高风险事件，并视情况通知数据主体。违规企业最高可面临2000万欧元或全球营业额4%的罚款。各成员国的数据保护机构负责监管及执法，欧洲数据保护委员会（EDPB）负责协调。

The GDPR grants data subjects a series of rights, including the right to access, rectify, delete, restrict processing, object to processing, data portability, and the right to object to automated decision-making. Its cross-border data transfer provisions require that such transfers may occur only if the destination country has obtained an EU “adequacy decision” (e.g., Japan) or implements safeguards such as Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs).Enterprises must comply with a range of obligations, including conducting Data Protection Impact Assessments (DPIAs), appointing a Data Protection Officer (DPO), and maintaining records of processing activities. The GDPR further mandates that in the event of a data breach, enterprises must report high-risk incidents to supervisory authorities within 72 hours and notify affected data subjects as appropriate. Violators may face administrative fines of up to €20 million or 4% of global annual turnover, whichever is higher. National data protection authorities are responsible for enforcement, coordinated by the European Data Protection Board (EDPB).

总体而言，GDPR强调数据主体的权利、严控企业责任与跨境数据流，已成为全球隐私保护的标杆。

In summary, the GDPR has become the global benchmark for privacy protection by strengthening data subject rights, imposing rigorous corporate accountability, and establishing stringent standards for cross-border data flows.

1.2 美国（CCPA等）制度要点/Key Features of the U.S. Privacy Framework (CCPA and Related Laws)

美国数据隐私保护采取“联邦分行业监管+州综合立法”的双轨模式，以加州《消费者隐私法案》（CCPA）及其修订案《加州隐私权法案》（CPRA）为核心标杆，形成“加州先行、各州差异化跟进”的分散格局。联邦层面通过《健康保险流通与责任法案》（HIPAA）、《儿童在线隐私保护法》（COPPA）等行业立法保护医疗、儿童等特定类型数据，而CCPA/CPRA等州法则广泛赋予消费者知情权、删除权、数据可携权、拒绝数据出售及共享权，并强制企业履行隐私政策披露、数据最小化与敏感信息（如生物识别、精确地理位置、种族、性取向等）额外保护义务。CPRA创新性设立加州隐私保护署（CPPA）作为专属监管机构，强化执法独立性与专业性。

The United States adopts a dual-track model of data privacy regulation, combining federal sector-specific oversight with comprehensive state-level legislation. The California Consumer Privacy Act (CCPA) and its amended version, the California Privacy Rights Act (CPRA), serve as the core benchmarks, establishing a decentralized pattern of “California taking the lead, followed by divergent approaches across other states.” At the federal level, industry-specific legislation such as the Health Insurance Portability and Accountability Act (HIPAA) and the Children’s Online Privacy Protection Act (COPPA) protects specific categories of data, including health and children’s data. In contrast, state laws such as the CCPA and CPRA grant consumers broad rights—including the right to know, the right to delete, the right to data portability, and the right to opt out of the sale or sharing of personal data—and impose corporate obligations concerning privacy policy disclosures, data minimization, and enhanced protection of sensitive personal information (such as biometric data, precise geolocation, race, and sexual orientation). The CPRA also innovatively establishes the California Privacy Protection Agency (CPPA) as an independent supervisory body, thereby strengthening enforcement independence and regulatory professionalism.

尽管拟议的《美国数据隐私与保护法案》（ADPPA）试图建立全国统一框架，但因州法优先权与敏感数据范围等争议，短期内更可能形成“联邦底线标准+州法特色补充”的动态协调体系。

While the proposed American Data Privacy and Protection Act (ADPPA) seeks to unify federal standards, controversies over state law preemption and sensitive data definitions make a "federal floor + state-specific enhancements" adaptive framework more likely in the near term.

1.3 中国大陆（PIPL）制度要点/Key Features of China’s Personal Information Protection Framework (PIPL)

中国《个人信息保护法》（PIPL）自2021年11月1日起施行，与《网络安全法》《数据安全法》共同构成国家数据治理的核心法律框架，确立了对境内及境外处理中国境内自然人个人信息的域外适用规则（如境外企业为中国用户提供社交媒体服务）。

China's Personal Information Protection Law (PIPL), which came into effect on 1 November 2021, forms the core legal framework for national data governance together with the Cybersecurity Law and Data Security Law. It establishes extraterritorial application rules that govern both domestic processing of personal information and overseas processing of personal information of natural persons within China (for example, foreign enterprises providing social media services to Chinese users).

PIPL以“告知—同意”为合法性基础，要求处理个人信息须取得主体明示授权，法定例外情形限于履行合同、应对突发公共卫生事件等特定场景；对生物识别、宗教信仰、医疗健康、金融账户、行踪轨迹及不满十四周岁未成年人信息等敏感数据，需单独取得充分同意并实施严格保护（如加密、去标识化）。

The PIPL takes "notice and consent" as the legal basis, requiring explicit authorization from data subjects for processing personal information. Statutory exceptions are limited to specific scenarios such as contract performance or responding to public health emergencies. For sensitive data including biometric data, religious beliefs, medical health information, financial accounts, location tracking, and information of minors under 14 years of age, separate full consent must be obtained and strict protection measures (such as encryption and de-identification) must be implemented.

个人享有查阅、复制、更正、删除、撤回同意及限制处理权，但未明确赋予GDPR式的数据可携带权（跨平台转移）。处理者需履行指定个人信息保护负责人（适用于处理超100万人信息或敏感数据的企业）、开展个人信息保护影响评估（PIA）、建立数据分类管理制度及定期合规审查等义务，重要互联网平台还需设立独立监督机构并定期发布社会责任报告。

Individuals are granted the rights to access, copy, correct, delete, withdraw consent, and restrict processing, but the PIPL does not explicitly provide for GDPR-style data portability rights (cross-platform transfers). Processors shall fulfill obligations including: appointing a personal information protection officer (applicable to enterprises processing information of over 1 million individuals or sensitive data), conducting Personal Information Protection Impact Assessments (PIA), establishing data classification management systems, and performing regular compliance reviews. Major internet platforms must additionally establish independent supervisory bodies and publish regular social responsibility reports.

跨境数据传输须满足以下条件之一：通过国家网信部门安全评估（适用于关键信息基础设施运营者或处理超100万人信息的企业）、签署网信办制定的《个人信息出境标准合同办法》细化条款、或通过专业机构认证。同时，关键信息基础设施运营者收集的个人信息须境内存储，确需出境的须通过安全评估。数据接收方需承诺达到中国保护标准，否则可终止传输。

Cross-border data transfers must satisfy at least one of the following conditions: passing a security assessment organized by the national cyberspace administration authority (applicable to critical information infrastructure operators or enterprises processing personal information of over 1 million individuals), signing the detailed clauses of the "Measures on Standard Contracts for Outbound Transfer of Personal Information" formulated by the cyberspace administration, or obtaining certification from a professional institution. At the same time, critical information infrastructure operators shall store collected personal information domestically, and outbound transfers must pass a security assessment if strictly necessary. Data recipients must commit to meeting Chinese protection standards; otherwise, the transfer may be terminated.

执法由国家互联网信息办公室统筹，行业主管部门协同监管。对违法处理个人信息行为，可责令整改、暂停业务、没收违法所得，并处最高5000万元或上一年度营业额5%的罚款；发生可能危害个人权益的数据泄露事件时，需立即向监管部门报告并通知受影响主体。PIPL在借鉴GDPR个人权利框架的基础上，强化数据本地化、安全评估等国家安全要求，允许为公共利益（如疫情防控）豁免同意规则，并加重大型平台主体责任，形成“个人权益保障、企业合规治理与数据主权维护”三位一体的中国特色数据治理体系。

Enforcement is led by the Cyberspace Administration of China, with collaborative supervision by industry authorities. For illegal personal information processing activities, the following measures may be imposed: ordering rectification, suspending business operations, confiscating illegal gains, and imposing fines of up to 50 million RMB or 5% of the previous year’s revenue. In the event of a data breach that may harm personal rights and interests, immediate reporting to regulatory authorities and notification of affected parties is required. The PIPL draws on the GDPR’s individual rights framework while strengthening national security requirements such as data localization and security assessments, allows exemptions from consent rules for public interests (e.g., epidemic prevention and control), and imposes heightened responsibilities on large-scale platforms. This forms a Chinese-characterized data governance system that integrates "protection of personal rights, corporate compliance governance, and maintenance of data sovereignty" into a tripartite framework.

（图表）（欧盟（GDPR）、美国（CCPA等）、中国大陆（PIPL）制度比较）

从上述比较可以看出，欧盟、美国和中国大陆虽均已建立起较为完善的个人信息保护框架。三大法域在合法性基础、数据主体权利、跨境机制及处罚强度上呈现出共性与差异并存的格局，企业在布局全球业务时必须据此制定针对性的合规路径。

Comparison of Data Protection Frameworks: EU (GDPR), U.S. (CCPA & State Laws), and Chinese mainland(PIPL)

From the above comparison, it is evident that the EU, the U.S., and Chinese mainland have each established relatively comprehensive personal information protection frameworks. These three jurisdictions demonstrate coexisting commonalities and divergences in legal bases, data subject rights, cross-border mechanisms, and penalty severity, necessitating tailored compliance strategies for global business operations.