PIPL China: Complete Guide to China's Data Privacy Law

The PIPL in China, formally the Personal Information Protection Law of the People's Republic of China, is the country's first comprehensive data privacy statute. Effective since November 1, 2021, PIPL China establishes rules governing how personal information of individuals within China must be handled by organizations anywhere in the world.

For businesses that serve Chinese users, operate websites accessible from China, or process data about individuals in China, the PIPL creates compliance obligations that cannot be ignored. This guide covers the law's scope, core requirements, cross-border transfer rules, enforcement mechanisms, and practical compliance steps. This content is educational and should not be treated as legal advice. Consult a qualified attorney familiar with Chinese law for guidance specific to your situation.

What Is the PIPL and Why Does It Matter?

The Personal Information Protection Law is one of three pillars of China's data governance framework, alongside the Cybersecurity Law (2017) and the Data Security Law (2021). Before the PIPL, China's personal data protection rules were scattered across various regulations and sectoral guidelines. The PIPL consolidated these into a single, enforceable statute modeled partly on the GDPR but shaped by China's distinct regulatory priorities.

The law matters for three reasons:

• Scale: China has over 1 billion internet users. Any business with a meaningful online presence accessible from China likely processes data covered by the PIPL.
• Extraterritorial reach: Like the GDPR, the China PIPL applies regardless of where the data processor is located, so long as the processing involves individuals in China.
• Enforcement severity: Penalties reach up to 50 million CNY or 5% of annual revenue, and regulators have shown willingness to act. The Cyberspace Administration of China (CAC) has already taken enforcement actions against major technology platforms.

Who Must Comply with the China PIPL?

Article 3 of the PIPL defines the law's scope. It applies to personal information processing activities that take place within China. Critically, it also applies extraterritorially in specific circumstances.

Domestic Processing

Any organization or individual that processes personal information within the territory of China must comply, regardless of whether the data subjects are Chinese nationals. This covers Chinese companies, foreign companies with operations in China, and any processing that occurs on servers or through personnel located in China.

Extraterritorial Application

Article 3(2) extends the PIPL to organizations outside China that process personal information of individuals in China for the following purposes:

• Providing products or services to individuals within China
• Analyzing or evaluating the behavior of individuals within China
• Other circumstances provided by laws or administrative regulations

This means a European e-commerce site that sells to Chinese customers, or a US-based analytics company that tracks behavior of users in China, falls within the PIPL's scope even without physical presence in China.

Organizations subject to extraterritorial application must establish a dedicated entity or appoint a representative in China and report their details to the relevant authority.

Core Principles and Legal Bases Under the PIPL

The PIPL establishes a set of processing principles that are recognizable to anyone familiar with the GDPR, but with notable differences in emphasis and application.

Processing Principles

Article 5 through Article 9 set out the foundational principles:

• Lawfulness and good faith: Processing must have a clear, reasonable purpose and be conducted in good faith
• Purpose limitation: Personal information must be collected for specific, defined purposes and not processed beyond what is necessary to achieve those purposes
• Minimization: Collection should be limited to the minimum scope necessary for the processing purpose
• Transparency: Individuals must be informed about processing activities in a truthful, accurate, and complete manner
• Accuracy: Personal information handlers must ensure data quality and avoid adverse effects from inaccurate or incomplete information
• Security: Appropriate measures must be taken to protect personal information

Legal Bases for Processing

Article 13 of the PIPL lists the lawful bases for processing personal information:

1. Consent of the individual
2. Necessity for concluding or performing a contract to which the individual is a party
3. Necessity for performing statutory duties or obligations
4. Necessity for responding to public health emergencies or protecting the life, health, or property safety of individuals in emergencies
5. Processing of publicly available personal information within a reasonable scope for news reporting, public opinion supervision, or similar activities in the public interest
6. Other circumstances provided by laws or administrative regulations

Unlike the GDPR, the PIPL does not include a "legitimate interest" basis. This is a significant difference that forces organizations to rely primarily on consent or contractual necessity for most commercial processing activities.

Consent Requirements

Consent under the PIPL must be informed, voluntary, and explicit. Separate consent is specifically required for processing sensitive personal information (Article 29), transferring data to third parties (Article 23), publishing personal information (Article 25), and cross-border transfers (Article 39). Individuals can withdraw consent at any time under Article 15, and withdrawal does not affect the lawfulness of prior processing.

Sensitive Personal Information Under the PIPL

The PIPL creates a distinct category for sensitive personal information with heightened requirements. Article 28 defines sensitive personal information as data that, if leaked or illegally used, could easily infringe the personal dignity or endanger the personal or property safety of an individual.

Specific categories include:

• Biometric data (fingerprints, facial recognition, voiceprints)
• Religious beliefs
• Specific identity information (government IDs)
• Medical and health data
• Financial account information
• Location tracking data
• Personal information of minors under the age of 14

Processing sensitive personal information requires:

• A specific and sufficient necessity for the processing
• Separate consent from the individual (Article 29)
• Prior notification of the necessity and impact on the individual's rights (Article 30)
• A Personal Information Protection Impact Assessment (Article 55)

The threshold for what qualifies as sensitive under the PIPL is arguably broader than the GDPR's "special categories" definition. Financial account information, for example, is explicitly listed as sensitive under the PIPL but is not a special category under Article 9 of the GDPR.

Cross-Border Data Transfers Under the China PIPL

The rules governing cross-border data transfers are one of the most distinctive and challenging aspects of the PIPL. Unlike the GDPR, which allows several transfer mechanisms with varying levels of regulatory oversight, the China PIPL imposes a more centralized approval process.

Transfer Conditions

Article 38 requires personal information handlers to meet at least one of the following conditions before transferring personal information outside China:

1. Security assessment by the CAC: Mandatory for critical information infrastructure operators and handlers processing personal information above thresholds set by the CAC
2. Personal information protection certification: Obtained from a professional institution recognized by the CAC
3. Standard contractual clauses: Concluded with the overseas recipient based on templates published by the CAC
4. Other conditions: As specified by laws, regulations, or the CAC

Additional Requirements

Beyond choosing a transfer mechanism, Article 39 requires handlers to:

• Obtain the individual's separate consent for the cross-border transfer
• Conduct a Personal Information Protection Impact Assessment
• Ensure the overseas recipient provides a level of protection meeting PIPL standards
• Keep records of the transfer

Data Localization

Article 40 mandates that critical information infrastructure operators and handlers processing personal information above CAC thresholds must store data collected within China domestically. Cross-border transfers from these operators require a CAC security assessment.

The CAC thresholds currently cover handlers processing personal information of more than one million individuals, or those transferring information of more than 100,000 individuals (or sensitive information of more than 10,000 individuals) cumulatively outside China since January 1 of the prior year.

Individual Rights Under the PIPL

The PIPL grants individuals a set of rights broadly comparable to, though not identical with, GDPR data subject rights. Article 44 through Article 49 establish the following:

• Right to know and decide: Individuals have the right to know about and make decisions regarding the processing of their personal information, and the right to restrict or refuse processing (Article 44)
• Right of access and copying: Individuals can request access to and copies of their personal information (Article 45)
• Right to correction and completion: Inaccurate or incomplete data must be corrected or supplemented upon request (Article 46)
• Right to deletion: Individuals can request deletion when the processing purpose has been achieved, consent is withdrawn, or the handler violates the law (Article 47)
• Right to explanation: Individuals can request an explanation of the processing rules applied to their personal information (Article 48)
• Portability: Article 45(3) provides a right to data portability where conditions prescribed by the CAC are met

Organizations should ensure their privacy policy clearly describes how individuals can exercise these rights, including contact methods and expected response timescales.

Enforcement and Penalties for PIPL Violations

The PIPL carries significant enforcement mechanisms. Article 66 establishes a tiered penalty structure.

Standard Violations

For general non-compliance, authorities can:

• Order corrections and issue warnings
• Confiscate unlawful gains
• Order suspension or termination of the application providing the service
• Impose fines of up to 1 million CNY on the organization
• Impose personal fines of 10,000 to 100,000 CNY on directly responsible persons

Serious Violations

For circumstances deemed "serious," the penalties escalate significantly:

• Fines of up to 50 million CNY or 5% of the prior year's annual revenue
• Suspension of relevant business activities
• Revocation of business permits or licenses
• Personal fines of 100,000 to 1 million CNY on responsible individuals
• Prohibition on responsible individuals from serving as directors, supervisors, or senior managers for a defined period

The enforcement bodies include the CAC, sector-specific regulators, and local government departments. The CAC has taken a leading role, conducting investigations into major Chinese technology companies and ordering app removals for PIPL violations.

Article 69 also establishes a fault-presumption liability model for civil claims. If a handler causes harm to an individual, the handler is presumed to be at fault unless it can prove otherwise, reversing the standard burden of proof.

How the PIPL Compares to the GDPR

Since many organizations already comply with the GDPR, understanding where the China PIPL diverges is the most practical path to dual compliance. Both laws require a lawful basis for processing, grant individuals access and deletion rights, apply extraterritorially, and require impact assessments for high-risk processing.

The key differences are where compliance strategies diverge:

• No legitimate interest basis: The PIPL does not recognize legitimate interest, forcing greater reliance on consent for commercial processing
• Government-controlled cross-border transfers: The GDPR offers multiple mechanisms (SCCs, adequacy decisions, BCRs), while the PIPL routes most transfers through CAC assessment, certification, or government-issued SCCs
• Data localization: The GDPR does not generally require local storage, while the PIPL mandates it for operators above CAC thresholds
• Personal executive liability: The PIPL imposes personal fines and career bans on responsible individuals, which the GDPR does not
• Broader state access: The PIPL includes provisions for government access to personal data on national security grounds that go beyond GDPR law enforcement frameworks
• Higher maximum fines: The PIPL caps at 50 million CNY or 5% of revenue, compared to the GDPR's 20 million EUR or 4% of turnover

GDPR compliance does not automatically satisfy the PIPL. Organizations need to assess their China-specific obligations independently.

Practical Compliance Steps for the China PIPL

If your website or application is accessible to individuals in China, or if you collect data from Chinese users through any channel, take these steps to begin addressing PIPL requirements.

Map Your Data Flows

Identify where personal information of individuals in China is collected, processed, stored, and transferred. Pay particular attention to data that crosses borders, as this triggers the most prescriptive requirements.

Review Consent Mechanisms

Since the PIPL does not recognize legitimate interest as a legal basis, many processing activities that rely on legitimate interest under the GDPR will require consent under the PIPL. Audit your consent flows and ensure you are obtaining separate consent where required, particularly for sensitive data and cross-border transfers.

Update Your Privacy Disclosures

Your privacy notices must meet Article 17 requirements, including the handler's identity, processing purposes, retention periods, and how individuals can exercise their rights. If you use a privacy policy generator, verify that the output addresses PIPL-specific disclosures in addition to GDPR and other framework requirements.

Assess Cross-Border Transfer Compliance

Determine whether your data transfers require a CAC security assessment, certification, or standard contractual clauses. If your cumulative cross-border transfers exceed CAC thresholds, the security assessment is mandatory.

Appoint a Local Representative

If your organization is outside China but subject to the PIPL's extraterritorial provisions, you must establish a dedicated entity or appoint a representative in China under Article 53.

Conduct Impact Assessments

Article 55 requires a Personal Information Protection Impact Assessment before processing sensitive personal information, using personal information for automated decision-making, entrusting processing to a third party, transferring information overseas, or engaging in any activity with significant impact on individuals.

Using a compliance platform like TermsBox to monitor what data your website collects through cookies, trackers, and third-party integrations can help you maintain an accurate picture of your data processing activities across jurisdictions, including under the PIPL.

Frequently Asked Questions

What is the PIPL in China?

The Personal Information Protection Law (PIPL) is China's comprehensive data privacy law, effective since November 1, 2021. It regulates how personal information of individuals within China is collected, stored, used, and transferred. It is often compared to the EU's GDPR but includes distinct requirements around data localization, cross-border transfers, and state access to data.

Does the China PIPL apply to companies outside China?

Yes. Article 3 of the PIPL applies extraterritorially to organizations outside China that process personal information of individuals located in China. This includes processing for the purpose of providing products or services to individuals in China, or analyzing and evaluating the behavior of individuals in China. Covered foreign organizations must establish a dedicated entity or appoint a representative within China.

What are the penalties for violating the PIPL in China?

The PIPL imposes penalties of up to 50 million CNY (approximately 7 million USD) or 5% of the prior year's annual revenue for serious violations under Article 66. Responsible individuals can face personal fines of up to 1 million CNY. The Cyberspace Administration of China can also order the suspension of business operations or revoke business licenses.

How does China's PIPL differ from the GDPR?

While both laws protect personal data and grant individual rights, the PIPL differs in several key areas. China's PIPL requires government approval for most cross-border data transfers, mandates data localization for certain operators, grants the Chinese government broader access to personal data for national security purposes, and defines consent requirements differently. The PIPL also imposes personal liability on company executives, which the GDPR does not.