What is PIPL?
The PIPL is China’s first comprehensive personal information law. It works together with the Cybersecurity Law (2017) and the Data Security Law (2021) to form the core of China’s data regulation. Many detailed rules come from CAC regulations and national standards.
Who does it apply to?
Processing of personal information within China. It also applies to processing outside China where the purpose is to provide products or services to individuals in China, or to analyse or assess their behaviour. Foreign processors caught this way must set up a representative or dedicated entity in China.
Key duties
- Lawful bases: consent and other bases, such as contract, HR management, legal duties, emergencies and news reporting. There is no general legitimate-interests basis.
- Separate consent is needed for sensitive personal information, public disclosure, provision to other processors and cross-border transfers.
- Sensitive personal information: biometrics, religious beliefs, medical and health data, financial accounts, location tracking, and information of minors under 14. It needs a specific purpose, necessity and strict protection.
- Rights: to know, decide, restrict, refuse, access, copy, transfer, correct and delete, and to an explanation of processing rules.
- Personal information protection impact assessments before high-risk processing.
- PI protection officer where processing volumes reach CAC thresholds, plus regular compliance audits.
- Incidents: take remedial measures immediately and notify the authorities and affected individuals.
Cross-border transfers
Data may leave China through a CAC security assessment, the standard contract, or certification, unless an exemption applies. Exemptions were broadened in 2024, for example for some contractual and HR transfers and for low volumes.
Enforcement
Serious violations can lead to fines of up to RMB 50 million or 5% of the previous year’s turnover, suspension of business, and fines on responsible individuals.
Sources and official references
- Cyberspace Administration of China — Cyberspace Administration of China (official source)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with National People's Congress of the PRC; administered mainly by the Cyberspace Administration of China (CAC).
