Decision guide

Can EU test-drive footage go to China? One flow answers it.

For OEMs and suppliers with test fleets in Europe and R&D in China: when the GDPR transfer rules apply, what they require, and what China requires, with every source linked.

Talk to us See the sources

The decision flow

One question decides the path.

1. Is the data still personal after anonymization?

Assess the dataset, not only the frames: faces and plates masked, but can GPS, lidar, timestamps or vehicle IDs single out, link or infer a person (WP29 Opinion 05/2014)?

If no

2. No: outside the GDPR

Anonymous data is outside the GDPR (Recital 26), so Chapter V does not apply. Keep the assessment on file; it is your evidence if the conclusion is questioned.

Yes

If yes

3. Yes: Chapter V applies

China has no adequacy decision. The transfer needs an Article 46 safeguard, typically standard contractual clauses (GDPR Chapter V).

4. The China side, on both paths

Without personal information or important data, data from activities such as international trade or multinational manufacturing is exempt from export filings (Article 3 of the 2024 CAC provisions). Personal information collected abroad, processed in China and sent back is exempt under Article 4, if no domestic personal information or important data is added.

Anonymize first, then transfer: how Marsstein AEON and the compliance platform work together.

Automotive

The EU side: anonymous or not.

The GDPR applies to personal data only. Recital 26 excludes anonymous information, meaning data that no longer relates to an identified or identifiable person, taking into account all means reasonably likely to be used to identify someone.

Vehicle camera data is rarely anonymous by default. Blurring faces and plates covers direct identifiers, but the dataset around the frames often carries GPS traces, precise timestamps, lidar point clouds and vehicle identifiers. The Article 29 Working Party (Opinion 05/2014) tests anonymization on three risks: singling out, linkability and inference. Where a dataset does not meet one of them, WP29 calls for a thorough evaluation of the identification risks.

The EDPB guidelines on connected vehicles (01/2020) recommend processing data locally where possible, and considering anonymization before data is transmitted outside the vehicle. Pseudonymized data remains personal data for whoever can re-identify it. In C-413/23 P (4 September 2025) the CJEU held that pseudonymized data may not be personal data for a recipient who cannot reasonably re-identify the people in it.

If the data stays personal: Chapter V.

Transfers of personal data to a third country are governed by Chapter V of the GDPR, Articles 44 to 49. China is not on the European Commission's list of countries with an adequacy decision, so a transfer needs appropriate safeguards under Article 46, in practice standard contractual clauses. The compliance platform keeps the chosen mechanism and its supporting documents together with the dataset.

This is enforced. On 2 May 2025 the Irish Data Protection Commission fined TikTok EUR 530 million, of which EUR 485 million was for infringing Article 46(1) GDPR in transfers of EEA user data to China.

The China side: where the data was collected decides.

For data collected in China, the CAC Several Provisions on Automotive Data Security (in force 1 October 2021) list video and image data from outside the vehicle containing faces and license plates as important data. Important data is to be stored in China, and exporting it requires a security assessment.

For data collected in Europe, the 2024 CAC Provisions on Promoting and Regulating Cross-Border Data Flows matter. Article 4 exempts personal information collected abroad, transmitted to China for processing and then provided abroad again from the export security assessment, standard contract and certification, as long as no domestic personal information or important data was introduced during processing. Article 3 exempts data from activities such as international trade and multinational manufacturing that contains no personal information or important data.

Anonymizing in the EU before the transfer therefore helps on both sides: it can take the data outside the GDPR and, if the dataset passes the anonymity assessment, keep personal information out of the round trip through China.

Sources