跨境数据传输：PDF 工具合规要点怎么逐条核对 / Cross-Border Data Transfer for PDF Tools

一句话结论 / Short answer

只要文件离开了你所在的辖区、落到另一国家的服务端，跨境数据传输就已经发生，不需要等到有人提醒。对 PDF 合并工具来说这条判断很短：三份带个人信息的文件拖进在线工具，按下合并，副本就在另一个辖区了。这篇把这件事拆成四个能当场填完的判定位，给出 GDPR 第 5 章与个保法第 38 条对着同一份文件各自怎么说，再把四条出境路径按实际成本排一次。

Once a file leaves your jurisdiction and lands on a server in another one, a cross-border data transfer has happened, whether or not anybody flagged it. For a PDF merge tool the test is short: three files carrying personal details dropped into an online merger, one click, and copies exist under another set of laws. This article turns that into four checks you can answer today, sets out how Chapter V of the GDPR and Article 38 of the PIPL read the same file differently, and prices the four legal routes against each other.

两种常见的错档方式。一种是把它归到大公司头上，团队不到二十人就直接跳过；另一种是反向过度，为每个工具都拉法务谈一轮标准合同条款，却没人算过更换成本。中间那一条路最实用：先确认有没有出境，没有就一行结案；有，再查哪个法域、走哪条路。

Two ways this usually goes sideways. One files it under something only large companies deal with and skips it below twenty people. The other overcorrects, pulling legal into standard contractual clause talks for every tool while nobody prices the alternative. The usable path sits between them: establish whether a transfer happens, close it in one line if not, and check the regime and the route if it does.

说明：下面是给工具选型和内部制度用的核对口径，不是法律意见。具体义务以适用法规和本单位法务的判断为准。

什么动作算一次传输 / What counts as a transfer

四个判定位按次序过。第一格答否，后面三格都不用填，这也是多数本地工具能在这节收工的原因。

Four checks, in order. Answer no to the first and the remaining three stay empty, which is why browser-local tools mostly finish this section in one line.

• 有没有离开本机：文件没被上传就没有传输，这条链路停在这一台设备上
• 接收方在哪个国家：注册地、处理机房所在国、CDN 节点所在国，三处经常不是同一个答案
• 有没有个人信息：公司之间的合同通常不涉及，加上姓名、证件号或诊断结论就涉及了
• 适用哪个法域：欧盟居民的数据看 GDPR，境内处理看个保法，两者也可能同时适用

• Leaves the device: no upload means no transfer, and the pipeline stops on this machine
• Where the recipient sits: registration country, processing region and CDN edge often give three answers
• Carries personal data: business-to-business contracts usually do not, adding a name, an ID number or a diagnosis changes that
• Which regime applies: GDPR for data about people in the EU, PIPL for processing inside mainland China, sometimes both

第二格最容易被想当然。一家在欧洲注册的公司，处理放在法兰克福，CDN 节点却可能落在北美或者东南亚的某个 PoP。用 ping 或 traceroute 看 IP 归属只能拿到一个大概，真正能写进表的是服务商自己的书面答复，对方不答就把「未公开」写进表格，这一格同样算填完了。

Row two gets assumed more than any other. A company registered in Europe may process in Frankfurt while its CDN edges sit in North America or Southeast Asia. Ping and traceroute give you an IP address and nothing beyond a guess, so what belongs in the table is a written answer from the vendor, and if they decline, writing not disclosed counts as answered too.

自己动手看请求面板的做法见 /blog/devtools-network-tab-privacy-guide，服务端与浏览器端这两条路的差别见 /blog/client-side-vs-server-side-pdf-tools。

三个法域对着同一份文件 / Three regimes, same file

拿同一个事实来比：用一个德国公司运营的在线 PDF 工具，合并三份包含中国员工体检信息的扫描件。三套规则给出的答案有一部分重叠，有一部分完全不一样。

Take one fact pattern and hold it up to three regimes: an online PDF tool run by a German company, merging three scans that contain health information about staff in China. Part of the answer overlaps, part of it does not.

最后一行是这两年最容易漏的一条变化：触发义务的方式分了档，不到十万人的路径和超过一百万人的路径，材料清单和办理周期差得很多。人数算不清的时候按更严的一档准备，因为退回重做的成本比一次多交材料高。

The last row is the change most people missed: obligations are tiered, and the route below one hundred thousand people looks nothing like the one above a million, neither in paperwork nor in processing time. When the headcount is unclear, prepare against the stricter tier, since refiling costs more than filing once extra.

GDPR 那一侧的逐条款清单见 /blog/gdpr-compliant-pdf-tools，个保法下八个能当场核对的点见 /blog/china-pipl-pdf-tools-requirements，医疗文件的额外要求见 /blog/hipaa-compliant-pdf-merge。

四条出境路径的成本 / Four routes and what each costs

确认确实有出境之后，剩下的是选一条合法路径。四条都成立，差别全在时间与人。

Once a transfer is real, what remains is choosing a lawful route. All four work, and the difference between them is measured in time and people.

第一条最省文件，也最脆：认定可以被推翻，去年可用不代表今年还能用。第四条看起来最贵，实际上常常只需要一个下午把流程换掉，之后每年省的正是前三条的复核工时。两者的差别类似于房贷和一次性付款。

Route one costs the least paperwork and breaks the easiest, since an adequacy finding can be withdrawn and last year answer may not hold this year. Route four looks the most expensive and usually costs one afternoon of migration, after which every year saved is review time you no longer spend on the other three. The gap resembles a mortgage next to a single payment.

本地处理为什么能结案 / Why local processing closes it

文件不出本机时，第二节的第二格没有接收方可填，第三、第四节跟着一起收敛，最后剩下的只有一句：无出境行为，不适用 transfer rules。这句话的效力比一份写得很完整的合同附录更强，因为它消掉的是整类问题，而不是降低其中一部分的风险。

When nothing leaves the device, the recipient cell in section two has no answer to give, sections three and four collapse with it, and what remains is one sentence: no transfer, transfer rules not applicable. That sentence carries more weight than a well drafted contract annex, because it removes a category of problem rather than reducing one part of it.

1. 把第二节第一格连同版本号一起写进表头，版本变更即触发复核
2. 附一句当天做过的验证方法：断网仍可用，请求面板无上传记录
3. 第三节和第四节写一句不适用，注明判断日期与核对人
4. 残余风险转写到设备那一章：磁盘加密、离职清理、屏幕共享的边界

1. Put the section two first cell into the header along with the tool version, so a version bump triggers a recheck
2. Attach the verification method you ran that day: works offline, no upload in the request panel
3. Close sections three and four as not applicable, with the assessment date and the person who checked
4. Move residual risk into the device chapter: disk encryption, offboarding cleanup, screen sharing limits

合并这一步在 pdfmergenext.shop 全程在本机完成，因此这一节通常只需要第一条和第二条：写上版本号，附上验证方法，结案。这套流程留痕的部分见 /blog/pdf-file-audit-trail-requirements，上一层的隐私影响评估写法见 /blog/privacy-impact-assessment-pdf-tools，零上传是怎么做到的见 /blog/how-zero-upload-pdf-tools-work。

Merging on pdfmergenext.shop runs entirely on your own device, so this section usually needs only rows one and two: note the version, attach the verification method, close it. The logging side of that workflow is in /blog/pdf-file-audit-trail-requirements, the assessment layer above it in /blog/privacy-impact-assessment-pdf-tools, and how zero upload is built in /blog/how-zero-upload-pdf-tools-work.

GDPR 的条款清单见 GDPR 合规 PDF 工具检查清单，个保法的八个核对点见 个保法下的 PDF 工具要求，全部文章在 /blog。