GDPR sareng Data Pangiriman: Anu Kedah Diurus ku Penjual Cina sacara saksama
perkenalan
Every parcel that leaves a factory in Dongguan or a warehouse in Shenzhen for a buyer in Lyon, Munich or Milan carries more than goods. It carries a name, a imah address, a mobile number, usually an email address, sometimes a tax identifier, and a trail of scan events that shows when a particular person was at home to receive it. For years, many Chinese sellers treated that information as an operational detail, something that lived in a spreadsheet, a label printer and a handful of chat groups. Under the EU General Data Protection Regulation, however, it is regulated personal data, and the way it moves between your store, your forwarder, your carriers and your customs brokers is a compliance question that regulators now take seriously.
The pressure has been building from both directions. In January 2025 the Austrian privacy group noyb filed complaints against TikTok, SHEIN, AliExpress, Temu, WeChat and Xiaomi over transfers of EU users’ data to China, asking regulators to suspend those transfers and to consider fines of up to 4 percent of global revenue. The Irish Data Protection Commission has since been examining SHEIN’s EU-to-China transfers, and the European Data Protection Board has made transparency, meaning the quality of privacy notices and customer communication, the focus of its 2026 coordinated enforcement action. On the Chinese side, the amended Cybersecurity Law took effect on 1 January 2026 with higher penalty ceilings, and the Cyberspace Administration of China has moved from issuing guidance to actually enforcing its cross-border data rules. A seller shipping to Europe now sits between two regimes that both want answers.
This guide is written for cross-border sellers, operations managers and anyone who signs forwarding contracts on behalf of an e-commerce business. It explains why GDPR applies to a Chinese seller, which shipping data counts as personal data, how the transfer rules really work when your forwarder sits in China, what Chinese law adds, and how to build a workflow that survives both a customer complaint and a regulator’s questionnaire. It is practical guidance rather than legal advice, so use it to ask better questions of your own counsel.
Why GDPR Reaches a Shipment Booked in Shenzhen
The most common misunderstanding among Chinese sellers is that GDPR only applies to companies with an office in Europe. The regulation says otherwise. Article 3(2) extends it to businesses outside the EU that offer goods or services to people in the EU, whether or not payment is taken. Regulators look for signals of intent: a storefront in German or French, prices in euros, delivery options to EU countries, a local domain, listings on an EU marketplace, or advertising aimed at European audiences. If your business does these things, you are inside the scope of the regulation regardless of where your company is registered.
Once you are in scope, the familiar obligations apply to you directly. You need a lawful basis for processing, a clear privacy notice, a way to answer access and deletion requests, reasonable security, a record of what you process, and a process for reporting breaches. Unless your sales into the EU are truly occasional and low risk, Article 27 also expects you to appoint a representative inside the EU who regulators and customers can kontak. A large share of small Chinese sellers have never taken that step, and it is one of the easiest gaps for an authority to spot.
Controller or processor: who is responsible for what
GDPR divides the world into controllers, who decide why and how personal data is used, and processors, who handle it on a controller’s instructions. In a typical shipping chain, the seller is the controller of its customers’ data. A freight forwarder that books space, prints labels and tracks parcels on your instruction is usually a processor. The same forwarder can also act as an independent controller for certain tasks, for example when it files customs declarations in its own name or keeps records it is legally required to retain. Carriers and last-mile delivery companies generally act as independent controllers because they decide how delivery is performed.
The distinction matters because it decides what paperwork you need. A processor relationship requires a written agreement under Article 28 that sets out instructions, security, sub-processor rules and deletion at the end of the service. An independent controller relationship does not require that agreement, but you still have to tell customers in your privacy notice that their data will be shared with delivery and customs parties.
Marketplace sales add a further layer. When an order comes through a platform such as Amazon or eBay, the platform is typically the controller of the buyer’s data and shares what is needed with the seller, who then becomes a controller in its own right for the fulfilment of that order. Platform seller terms usually contain data protection clauses, and sellers who never read them often discover later that they accepted obligations such as using the data only for fulfilment and deleting it afterwards.
Representatives, officers and the UK
Beyond Article 27, a data protection officer is only mandatory for organisations doing large-scale monitoring or processing special categories of data, so most sellers will not need one, although naming a responsible person internally is wise. Remember that the United Kingdom runs its own version of the regulation, known as UK GDPR, with its own representative requirement and its own transfer tools. A seller serving both the EU and Britain needs to cover both, and Switzerland’s revised data protection act adds a third, smaller layer.
What Counts as Personal Data in a Shipping Workflow
Personal data means any information relating to an identifiable person, and shipping documents are full of it. The table below lists the data elements that most often move through an e-commerce shipment and explains why each can become a problem in practice.
| Unsur data | Dimana nembongan | Naha éta penting dina praktékna |
| Recipient name and address | Shipping label, commercial invoice, customs entry summary declaration | Directly identifies a person and is copied to many parties along the chain |
| Nomer telepon sélulér | Last-mile carrier manifest, SMS delivery notices | Frequently pasted into chat groups and shared with several carriers |
| Alamat email | Tracking notifications, customs queries | Easily reused for marketing without a lawful basis |
| Tax and identity numbers (VAT, EORI, IOSS, national ID in some lanes) | Customs declarations and clearance files | Higher fraud and identity theft risk if leaked |
| Order contents | Commercial invoice, packing list, parcel description | Can reveal health conditions, religion or private life, which attracts stricter rules |
| Proof of delivery (signature, doorstep photo) | Carrier delivery system | Shows the home of the recipient and sometimes other people |
| Tracking history and IP data | Tracking pages, transport management systems | Reveals behaviour patterns and counts as an online identifier |
Two points surprise many sellers. First, order contents can turn ordinary data into sensitive data. A parcel of orthopaedic supports, religious items or adult products tells a reader something about the buyer’s health, beliefs or intimate life, and GDPR treats information of that kind with extra caution. Writing a precise product description on a commercial invoice is a customs requirement, but copying that description into every chat message about the parcel is not.
Second, business customers are not exempt. Contact persons at a company, sole traders and partners are individuals, and their names, direct lines and delivery addresses are personal data. A B2B seller shipping pallets to a distributor still holds personal data in the consignee contact fields.
The most overlooked leak is informal. Operations staff often send screenshots of labels, waybills and customer messages through WeChat or WhatsApp groups that include warehouse workers, drivers and agents. Those groups have no access controls, no retention limit and no record of who saw what. If a regulator asks how you protect customer data in transit, an old chat group full of address screenshots is the answer you do not want to give.
The Real Transfer Problem: China Has No Adequacy Decision
Chapter V of GDPR, covering Articles 44 to 50, restricts the transfer of personal data to countries outside the European Economic Area unless one of several conditions is met. The simplest condition is an adequacy decision, in which the European Commission has formally recognised that a country offers essentially equivalent protection. Japan, South Korea, the United Kingdom and Switzerland are on that list, and the United States qualifies only for companies certified under the EU-US Data Privacy Framework. China is not on the list, and there is no sign that it will be soon.
That is why transfers to China are the centre of current enforcement. Without adequacy, a transfer needs an alternative safeguard, most commonly the Standard Contractual Clauses adopted by the Commission in 2021, together with an assessment of whether the destination country’s laws allow those clauses to work in practice. Regulators have made clear that this assessment is not a formality.
Is every flow really a transfer?
Not every movement of data across the border counts as a Chapter V transfer. The European Data Protection Board’s guidelines on the interplay between Article 3 and Chapter V say that a transfer needs an exporter subject to GDPR, a disclosure of data to a separate importer, and an importer located in a third country. When a European customer types an address directly into your own website and that data lands with your own company in China, the data goes from the individual to the controller and the guidelines do not treat that step as a transfer. GDPR still applies in full to everything you do with the data afterwards, and the EDPB has noted that extra safeguards are advisable for exactly this situation.
The picture changes as soon as the data is passed on to another party. A Chinese seller that sends customer data to a separate forwarder, a warehouse operator or a platform service provider is disclosing it to a different legal entity, and the careful working assumption is that Chapter V safeguards are needed for that onward disclosure. The table below sets out how the usual shipping scenarios are best treated.
| Skenario | Likely GDPR treatment | mékanisme has |
| EU buyer enters data directly on the seller’s own site in China | Not a Chapter V transfer in itself, but GDPR applies fully to the seller | Privacy notice, lawful basis, EU representative, security |
| EU marketplace passes order data to a seller in China | Transfer from the platform to the seller | Platform data terms and Standard Contractual Clauses |
| Seller sends order data to a forwarder or 3PL in China | Onward disclosure to a separate entity in a third country | Article 28 agreement plus Standard Contractual Clauses and a transfer assessment |
| Forwarder passes data to a carrier or customs broker in the EU or UK | Data enters the EU, where the recipient is directly subject to GDPR | Controller or processor terms, shipment-specific minimisation |
| Forwarder or seller sends data to a warehouse in the United States | Transfer to a third country | Data Privacy Framework certification of the recipient, or Standard Contractual Clauses |
| Pre-arrival customs data required by EU rules | Legally required disclosure, partly covered by derogations | Article 49 derogations, applied narrowly, plus minimisation |
Standard Contractual Clauses and transfer impact assessments
The 2021 Standard Contractual Clauses come in four modules: controller to controller, controller to processor, processor to processor and processor to controller. A seller using a Chinese forwarder as its processor would normally rely on the controller-to-processor module. The clauses on their own are not enough. Since the Schrems II judgment of the Court of Justice in July 2020, the exporter must assess whether the laws and practices of the destination country, including government access to data, undermine the protection the clauses promise, and must add supplementary measures where they do.
For China, this assessment is uncomfortable. Laws such as the National Intelligence Law of 2017 and the Data Security Law place duties on organisations and individuals to cooperate with state authorities, and European regulators have read these as giving authorities broad access powers. Technical measures such as encryption help when data is merely stored, but a forwarder that must read an address in order to print a label cannot work with data it cannot see. In practice this pushes sellers towards the measures that really are within their control: sending fewer fields, sending them later, deleting them sooner, and limiting access to named staff.
The Irish Data Protection Commission’s decision against TikTok in May 2025 shows how this reasoning plays out. The regulator fined the company 530 million euros, finding among other things that it had not verified that data accessed from China received a level of protection essentially equivalent to that in the EU. TikTok is far larger than any typical seller, but the legal logic applies to everyone: if you send data to China, you are expected to have examined Chinese law and documented why your safeguards still work.
The United States leg of your supply chain
Many Chinese sellers ship stock in bulk to a United States warehouse and fulfil orders from there. Where European or British customer data goes to that warehouse, the EU-US Data Privacy Framework offers a simpler route than Standard Contractual Clauses, provided the warehouse operator is certified and the certification covers the relevant data. The Framework has survived a legal challenge before the EU General Court in September 2025, although further challenge remains possible, so keep fallback clauses in your contract in case the Framework is ever invalidated. For purely domestic United States orders, GDPR does not apply, and state privacy laws are the relevant concern instead.
China’s Side of the Ledger: PIPL, the Data Security Law and the 2026 Changes
A seller who focuses only on Brussels will be caught out by Beijing. China’s Personal Information Protection Law came into force in November 2021 and is broadly comparable to GDPR, with consent and other legal bases, individual rights, impact assessments and heavy penalties. It sits alongside the Data Security Law and the Cybersecurity Law, which together form the foundation of China’s data governance. The amended Cybersecurity Law that took effect on 1 January 2026 increased penalty ceilings across several categories of violation, and commentators have noted that the Cyberspace Administration has shifted from education to enforcement, including against companies that failed to follow a cross-border transfer decision.
Which Chinese rules apply to a given seller depends on whose data is involved. Information about Chinese consumers, employees, suppliers and the senders of return parcels is covered by PIPL, and sending it abroad triggers the outbound transfer regime. Information about European customers that is collected outside China and simply processed in China gets more relief: the 2024 rules on promoting and regulating cross-border data flows exempt data that was collected and generated overseas and transferred into China for processing, so long as no domestic personal information or important data is mixed in. A seller that keeps its EU order data cleanly separated from Chinese customer data therefore faces a lighter burden under Chinese law, though it still has to satisfy GDPR.
For personal information collected in China, the 2024 rules also introduced thresholds that decide which transfer mechanism is required. The table summarises them as they apply to non-sensitive and sensitive data exported in a year.
| Volume of China-origin personal information exported | Sarat umum |
| Fewer than 100,000 individuals (non-sensitive data), counted from 1 January | Generally exempt from filing |
| 100,000 to 1 million individuals (non-sensitive) or fewer than 10,000 (sensitive) | Standard contract filing or certification |
| 1 million or more individuals, or 10,000 or more sensitive records | Security assessment by the Cyberspace Administration |
| Transfer genuinely necessary to perform a contract, such as cross-border shopping, delivery or payment | Exempt from the three mechanisms above |
The contract-necessity exemption is the one most relevant to shipping, because delivering a purchase to an overseas buyer is the textbook example of a necessary transfer. A new certification pathway, set out in measures that took effect on 1 January 2026, gives organisations a third-party certification route as an alternative to filing standard contracts. Thresholds and definitions change regularly, so confirm the current position with a qualified Chinese lawyer before relying on any exemption.
When the two regimes collide
The two systems do not always fit together. Article 41 of PIPL and Article 36 of the Data Security Law require approval before personal data held in China is handed to foreign judicial or law enforcement bodies, while GDPR’s Article 48 says a foreign court order alone does not justify a transfer. For a seller the lesson is practical. Do not make absolute promises in your privacy notice about who can or cannot access data, describe your recipients and transfer tools honestly, and keep a record of how you decided which law governs which dataset.
What Enforcement Looks Like for Small and Mid-Size Sellers
GDPR sets two tiers of administrative fines. The lower tier reaches 10 million euros or 2 percent of worldwide annual turnover, whichever is higher, and covers organisational failures such as missing processor contracts or incomplete records. The upper tier reaches 20 million euros or 4 percent of turnover and covers breaches of the core principles, data subject rights and the transfer rules.
| golongan | denda maksimum | Shipping examples |
| Lower (Article 83(4)) | 10 million euros or 2 percent of turnover | No Article 28 agreement with the forwarder, no record of processing, late or missing breach notice |
| Upper (Article 83(5)) | 20 million euros or 4 percent of turnover | Transfers without a valid safeguard, no lawful basis, ignored access requests, misleading privacy notice |
A small seller is unlikely to receive a fine at the maximum. What it is far more likely to face is a customer complaint to a national authority, a questionnaire from a marketplace or payment provider, a suspended listing, or a forwarder that suddenly refuses to handle EU parcels without proper paperwork. Complaints are cheap to file and some privacy organisations provide templates, so the risk is not that a regulator targets you in particular but that a single unanswered access request turns into a formal case.
The EDPB’s 2026 action on transparency is worth noticing for another reason. Privacy notices are public, so a regulator can assess yours without opening an investigation. A notice that does not name the countries where data goes, the categories of recipients or the transfer safeguards is visible evidence of a gap.
Building a Compliance Workflow Around Shipping Data
Good compliance in logistics is mostly about knowing where data goes and cutting the number of places it goes. The steps below follow the order in which most sellers can realistically implement them.
Map the data before you fix anything
Start with a one-page data map. List every system that touches order data, from your storefront and marketplace dashboards to your order management tool, your forwarder’s portal, your carriers’ systems and your accounting software. For each, note which fields enter, who can see them, which country the system sits in and how long the data stays. Most sellers discover two or three flows they had forgotten, such as a customer service tool that stores full addresses or a freelancer who keeps order exports on a personal laptop.
Put the forwarder’s role into a contract
If your forwarder processes customer data for you, you need an Article 28 agreement, and the Standard Contractual Clauses if the forwarder is in China. A usable agreement states what the forwarder may do with the data, requires confidentiality from its staff, lists its sub-processors such as local carriers and customs brokers, commits it to assist with access and deletion requests, and requires deletion or return of data when the contract ends. It should also set a breach notification deadline that fits your own obligations. Because you must notify the supervisory authority within 72 hours of becoming aware of a breach, a forwarder that promises to tell you within 24 to 48 hours is far more useful than one that says only that it will notify you without undue delay.
Send less data, to fewer parties
Data minimisation is the single most effective control available to a seller. Ask what each party genuinely needs. A customs broker needs the consignee’s name, address and tax identifier but not the buyer’s email address or order history. A line-haul carrier may need only the consignee at the warehouse. Only the last-mile carrier needs a phone number, and often only for the delivery window. Strip marketplace buyer messages, order notes and payment details from the data you share, and move label and waybill handling from chat groups into a system with role-based access and logs.
Decide how long you keep each type of data
Retention is where good intentions most often fail. Customs and tax records have to be kept for years, but the personal details attached to a delivered order rarely need to survive that long. The table sets out starting points that many compliance teams use, though they should be checked against the rules of the countries you ship to.
| Kategori data | Suggested retention | alesan |
| Customs declarations and commercial invoices | Typically 3 to 10 years depending on country and role | Customs and tax record-keeping rules |
| Nyukcruk acara | 12 mun 24 bulan | Dispute handling and carrier claims |
| Proof-of-delivery photos and signatures | 3 to 6 months unless a claim is open | Proportionality, the images show private homes |
| Customer phone and email in forwarder systems | Delete or anonymise 30 to 90 days after delivery | No continuing operational need |
| Returns and claim files | Until the claim limitation period ends | Defence of legal claims |
Be ready for breaches and customer requests
Write a short incident procedure that names who decides whether a breach is reportable, who contacts the forwarder, and who drafts the notice to the authority and to affected customers. Test it once. For access, correction and deletion requests, GDPR gives you one month to respond, extendable by two further months in complex cases, and you will usually need your forwarder’s help to find all relevant records. Agree in advance how quickly it must respond to your requests, otherwise your deadline will pass while you wait.
Finally, update your privacy notice so that it says plainly which categories of data you collect, why you use them, who receives them, which countries they go to, which safeguard applies and how long you keep them. Use clear language in the languages of the markets you sell to. A notice that is accurate and specific will protect you better than one that is long and vague.
Choosing a Freight Forwarder With Data Protection in Mind
Most sellers choose forwarders on price, transit time and reliability. Data handling rarely comes up until something goes wrong. Adding a few questions to the selection process costs nothing and tells you a great deal about how a provider actually runs its operation.
| Patarosan anu kedah ditaroskeun | Kumaha sora jawaban anu saé |
| Will you sign an Article 28 agreement and the Standard Contractual Clauses? | Yes, with a standard template ready and a named contact for questions |
| Which sub-processors and countries are involved in my shipments? | A current list of carriers, brokers and warehouses, updated when it changes |
| Who inside your company can see consignee data? | Role-based access, a short named group, and access logs |
| How long do you keep personal details after delivery? | A defined schedule that separates customs records from contact details |
| How fast will you tell me about a breach? | A commitment measured in hours, not a vague promise |
| How do you handle label and waybill data internally? | A managed system, not personal chat apps or shared drives |
The answers matter as much as the paperwork. A provider that hesitates, redirects to a sales manager, or tells you that data protection is the seller’s problem has not built it into its process. Since you remain responsible as controller, that provider becomes your risk.
How Topway Shipping Helps Sellers Reduce Data Exposure
Since 2010, Topway Shipping, headquartered in Shenzhen, China, has provided cross-border e-commerce logistics solutions, and its founding team brings more than 15 years of experience in international logistics and customs clearance, with a strong focus on China to United States transportation. The company covers the whole chain: first-leg transportation, overseas gudang, customs clearance and last-mile delivery, along with flexible full-container-load and less-than-container-load ocean freight from China to major ports worldwide. For a seller worried about data protection, that structure has practical value.
The reason is that risk in logistics comes from handoffs. Every additional vendor that receives a spreadsheet of consignee details is another party to paper, audit and monitor. When first-leg transport, warehousing, clearance and delivery are coordinated by one provider, sellers have fewer separate contracts to negotiate and fewer places where order data is copied. Sellers working with Topway Shipping can raise their data processing agreement and transfer requirements at onboarding and have them reflected across the services they use rather than negotiating them separately with each subcontractor.
Ocean freight changes the data picture further. A seller that moves inventory in bulk by FCL or LCL to an overseas warehouse sends a shipment whose consignee is its own warehouse, not an individual shopper. Customer-level data is then needed only when orders are fulfilled locally, rather than accompanying each parcel across the border from China. For sellers serving American customers, this model keeps consumer data movement to a minimum on the first leg and limits the points at which it has to be shared. Sellers who also sell into Europe or the UK can use the same principle: ship stock in bulk, fulfil locally, and keep the personal data of European buyers within the smallest possible circle.
Topway Shipping’s advice to sellers is straightforward. Share only the fields each stage requires, agree retention periods at the start of the relationship, and keep communication about individual consignees inside controlled systems rather than informal groups. Sellers who want to review their current shipping data flows or need help matching their service mix to their compliance obligations can speak with the Topway Shipping team before shipments begin.
Rencana Aksi 90 Dinten
Compliance can look overwhelming when presented as a list of laws. Broken into stages, it is manageable for a small team. The following plan assumes a seller with an existing EU customer base and no formal programme.
| Jangka waktos | aksi | Nu boga anu disarankeun |
| Dinten 1 dugi ka 15 | Build the data map, identify every system and chat group that holds consignee data, stop sharing labels through informal groups | Pimpinan operasi |
| Dinten 16 dugi ka 30 | Update the privacy notice, appoint an EU and UK representative if needed, name an internal data protection contact | Compliance or legal |
| Dinten 31 dugi ka 60 | Sign processor agreements and Standard Contractual Clauses with forwarders and warehouses, complete transfer assessments for China and the United States | Procurement with counsel |
| Dinten 61 dugi ka 90 | Set retention schedules, test the breach procedure, run a mock access request, review marketplace data terms | Operations and customer service |
Repeat the exercise yearly or whenever you add a new market, carrier or warehouse. Compliance that is updated as the business changes is much less expensive than compliance rebuilt after a complaint.
kacindekan
For Chinese sellers, GDPR is not an overseas formality. It follows your parcels from the moment a European buyer places an order, through your forwarder’s systems, onto a carrier’s manifest and into a customs file. The lack of an adequacy decision for China, the visible actions against large Chinese platforms and the growing enforcement activity inside China itself mean that data handling in logistics is now a commercial issue as well as a legal one. Marketplaces, payment providers and business customers increasingly ask for proof, and sellers who can answer clearly win and keep business that others lose.
The good news is that most of the effort is operational rather than legal. Map where data goes, put proper contracts in place, send less information to fewer parties, delete it when it has served its purpose and tell customers honestly what you do. Choose logistics partners who treat these steps as normal. A provider such as Topway Shipping, which runs the chain from first-leg transport through overseas warehousing, customs clearance and last-mile delivery, can help you shorten the data trail and keep your obligations manageable as you grow.
FAQs
Q: Does GDPR apply to me if my company and warehouse are both in China?
A: Yes, if you offer goods to customers in the EU. Article 3(2) applies based on whom you target, not where you are based, so a Chinese seller with a European-facing store is in scope.
Q: Do I really need an EU representative?
A: Usually yes. Article 27 requires one unless your processing is occasional, low risk and does not involve large-scale sensitive data, and regular sales to EU customers rarely meet that test.
Q: Is my Chinese freight forwarder a processor?
A: In most cases it is a processor for the work it does on your instructions, and an independent controller for some legally required tasks. Sign an Article 28 agreement and cover the China transfer with Standard Contractual Clauses.
Q: Can I rely on customer consent to send data to China?
A: Consent is a narrow and fragile basis for routine shipping flows. Regulators treat it strictly, so build on contract necessity and proper safeguards instead.
Q: How long should I keep consignee details after delivery?
A: Keep customs records for the period national rules require, but delete or anonymise contact details such as phone and email within a short, defined window after delivery, often 30 to 90 days.
Q: What should I do first if I have done nothing so far?
A: Map your data flows, stop sharing labels in chat groups, update your privacy notice and request a data processing agreement from your forwarder. Those four steps close the most visible gaps quickly.
