🇨🇳China

China's data compliance framework is anchored by a single comprehensive personal information law sitting inside a wider data-governance regime

China's personal information protection regime is anchored by the Personal Information Protection Law (PIPL), in force since 1 November 2021. PIPL is China's first comprehensive, standalone statute governing the processing of personal information by organisations and individuals, and it is the instrument that creates the accountability framework most international organisations must operate against. PIPL does not stand alone, however. It interlocks with two earlier statutes — the Cybersecurity Law and the Data Security Law — and with a dense and still-expanding body of implementing rules and standards issued by the Cyberspace Administration of China (CAC), the lead regulator. PIPL itself cross-references the broader regime at specific points: its cross-border transfer regime ties into the security-assessment machinery, and its rules on critical information infrastructure operators draw on definitions established elsewhere. Understanding PIPL means understanding both what the law says directly and where it hands off to the surrounding framework.

The three pillars to understand first

PIPL (the Personal Information Protection Law) answers the core legal question: on what basis may an organisation process personal information, and what duties does it owe to the individual? Its central idea is a narrow set of lawful processing bases. Article 13 lists the only circumstances in which personal information may be processed — consent being the first and, in practice, the dominant one. Critically, PIPL contains no broad "legitimate interest" basis equivalent to the GDPR's Article 6(1)(f). Where an organisation accustomed to GDPR would lean on legitimate interest, PIPL generally requires consent instead. The law layers a distinctive separate-consent requirement on top of ordinary consent for higher-risk processing: sensitive personal information, cross-border transfer, public disclosure, and providing personal information to other processors each demand a discrete, specific consent rather than a bundled one.

The CAC cross-border transfer regime answers the export question: how may personal information lawfully leave China? Article 38 establishes three principal routes — a CAC-organised security assessment, certification by a specialised body, or a standard contract concluded with the overseas recipient on the CAC's prescribed template. Critical information infrastructure operators and processors handling personal information above CAC-specified volume thresholds must store data domestically and, where export is genuinely necessary, pass the security assessment (Article 40). This regime is one of the densest and most operationally demanding parts of PIPL, and it is where international data flows most often run into compliance exposure.

The governance and obligations framework (Chapter V) answers the accountability question: what must the organisation build, appoint and assess? PIPL requires processors above CAC-specified volume thresholds to designate a person in charge of personal information protection (Article 52), requires overseas processors caught by the extraterritorial scope to establish a dedicated agency or appoint a local representative within China (Article 53), mandates regular compliance audits (Article 54), and requires a personal information protection impact assessment (PIPIA) before defined high-risk processing activities (Article 55). Large platform operators carry additional "gatekeeper" obligations under Article 58.

How these elements work together

A lawful processing basis under Article 13 is the entry condition, but it is not the whole obligation. A processor that has obtained ordinary consent but not the separate consent required for a cross-border transfer under Article 39 is non-compliant on the transfer even if the underlying collection was lawful. A transfer that has separate consent but has not satisfied one of the Article 38 export mechanisms — security assessment, certification or standard contract — is still unlawful. A processor that has built consent and transfer machinery but has not conducted the PIPIA required by Article 55 for sensitive-information or automated-decision processing has a documented gap that surfaces in any CAC audit or interview under Article 64.

These obligations operate across the same data lifecycle and should not be managed in silos. Consent design, sensitive-information handling, cross-border governance, the PI-protection officer function, PIPIA records and breach response all reference each other. The extraterritorial reach of Article 3 means an organisation outside China can be fully within scope — and therefore owe the local-representative obligation under Article 53 — purely by offering products or services to, or analysing the behaviour of, individuals in China.

What organisations should prioritise

Start by establishing whether PIPL applies at all — and Article 3's extraterritorial limb means many organisations with no physical China presence are caught. Then map every processing activity to a specific Article 13 basis, and identify where the narrower PIPL basis set leaves a gap that GDPR's legitimate-interest basis would have filled. Audit every consent flow for the separate-consent triggers: sensitive personal information, cross-border transfer, public disclosure and third-party sharing each require their own discrete consent under Articles 23, 25, 29 and 39.

For organisations transferring personal information out of China, the cross-border regime should be treated as a project in its own right: determine which Article 38 route applies, assess whether volume thresholds or critical-information-infrastructure status trigger mandatory security assessment and data localisation under Article 40, and document the necessity of each export. Above the CAC thresholds, appoint the PI-protection officer, establish the local agency or representative if caught extraterritorially, build the PIPIA process for the Article 55 triggers, and stand up a breach-notification procedure aligned with Article 57. Stay conservative where CAC thresholds and implementing-rule detail are not yet settled — the framework continues to develop through subordinate regulation.