AI, GDPR and Cross-Border Data Governance: Challenges for Multinational Corporations

Abstract

This thesis explores the complex legal frictions multinational corporations face when deploying Artificial Intelligence systems across the European Union and China. It first examines the cumulative compliance burden within the EU, detailing how the GDPR and the EU AI Act jointly regulate AI through strict requirements on data minimization, algorithmic transparency, and automated decision-making. The core of the research investigates the profound regulatory friction in cross-border data transfers between the EU's fundamental rights-driven regime and China's sovereignty-centric framework, which is governed by the PIPL, DSL, and CSL. Specifically, the European regulations and concerns regarding Chinese state access create a legal obstacle for enterprises relying on traditional data export mechanisms. Consequently, this systemic friction often forces companies into immense administrative and technical costs. To resolve this dilemma, the research proposes a comprehensive framework introducing technologies such as the PETs as mandatory legal safeguards. Ultimately, the thesis concludes that multinational corporations must shift from reactive compliance to proactive legal design, operate with unified organizational governance to successfully navigate the EU-China data corridor.