Guide
Vehicle data to China, with standard contractual clauses.
If camera data stays personal after anonymization, a transfer to China needs an Article 46 GDPR safeguard, in practice the EU standard contractual clauses. What they ask for, in four steps.
Four steps
From the dataset to a transfer you can defend.
1. Check whether the data stays personal
If the dataset is anonymous after assessment, Chapter V does not apply and the rest of this page is not needed. The EU to China guide shows the decision.
2. Choose the module
The clauses have four modules: controller to controller, controller to processor, processor to processor, processor to controller. Which one fits depends on who decides about the data in China.
3. Assess law and practice in China
Under Clause 14 the parties warrant that they have no reason to believe that the laws and practices of the destination country prevent compliance, taking into account the circumstances of the transfer and those laws and practices.
4. Document and keep watching
The assessment is documented and made available to the supervisory authority on request (Clause 14(d)); the importer notifies the exporter if it becomes subject to laws or practices that conflict (Clause 14(e)).
What the law says.
China has no EU adequacy decision. Transfers of personal data therefore need appropriate safeguards under Article 46 GDPR (Chapter V), in practice the standard contractual clauses of Implementing Decision (EU) 2021/914.
The clauses alone are not the whole job. Under Clause 14 the parties warrant that the laws and practices of the destination country do not prevent compliance, document that assessment, and make it available to the supervisory authority on request.
This is enforced. On 2 May 2025 the Irish Data Protection Commission fined TikTok EUR 530 million in total, of which EUR 485 million for infringing Article 46(1) GDPR in transfers of EEA user data to China.
The simplest transfer is the one the GDPR does not cover: a dataset that is anonymous after assessment under WP29 Opinion 05/2014 is outside the GDPR (Recital 26) and so outside Chapter V.
Frequently asked questions
Your question is not listed? Ask us directly.
Talk to usWhich safeguard does a transfer of vehicle data to China need?
As a rule, standard contractual clauses under Article 46 GDPR, because China has no adequacy decision (Implementing Decision (EU) 2021/914).
What does Clause 14 require?
A warranty that the laws and practices of the destination country do not prevent compliance with the clauses, based on an assessment that is documented and made available to the supervisory authority on request (Clause 14).
Do I need standard contractual clauses if the data is anonymized?
No, if the dataset is actually anonymous after assessment: anonymous data is outside the GDPR (Recital 26) and therefore outside Chapter V.
Sources
Primary sources
Every legal statement on this page rests on one of these documents.
- GDPR Recital 26Anonymous data is outside the GDPR.
- GDPR Chapter V, Articles 44-49Rules for transfers of personal data to third countries.
- Article 29 Working Party, Opinion 05/2014Singling out, linkability and inference as the tests for anonymization.
- European Commission, adequacy decisionsCountries with an EU adequacy decision; China is not among them.
- Irish DPC, TikTok decision (2 May 2025)EUR 485 million for Article 46(1) GDPR transfers to China.
- Commission Implementing Decision (EU) 2021/914The standard contractual clauses, including Clause 14 on local laws and practices.
