🇨🇳Personal Information Protection Law

← Back to laws in China

A law built on a closed list of bases, not a balancing test

The Personal Information Protection Law (PIPL) is China's first comprehensive, standalone law governing the processing of personal information. It was adopted by the Standing Committee of the National People's Congress on 20 August 2021 and came into force on 1 November 2021. It is often described as China's GDPR, and the resemblance is real at the level of vocabulary — notice, consent, individual rights, impact assessments — but the structural differences matter far more than the surface similarities.

The most important difference is the basis for processing. Under Article 13, personal information may be processed only where one of a closed list of circumstances applies. The first is the individual's consent. The others are narrow and specific: necessity for a contract to which the individual is a party or for human-resources management under lawfully adopted labour rules; necessity to perform a statutory duty or obligation; necessity to respond to a public-health emergency or to protect life, health and property in an emergency; processing within a reasonable scope for news reporting or public-opinion supervision in the public interest; reasonable processing of information the individual has already disclosed or that is otherwise lawfully public; and other circumstances set by law. There is no general legitimate-interest basis. Organisations accustomed to GDPR's Article 6(1)(f) routinely assume a flexibility that PIPL does not grant — and that assumption is the single most common source of compliance failure.

Who the law covers — and how far its reach extends

PIPL applies to the processing of personal information of natural persons within the territory of China (Article 3). It then extends extraterritorially: it also applies to processing carried out outside China where the purpose is to provide products or services to individuals in China, or to analyse and evaluate the behaviour of individuals in China. This means an organisation with no establishment, servers or staff in China can be fully within scope purely by virtue of who its product is aimed at. There is no revenue or headcount threshold for the law to apply.

PIPL uses a role vocabulary that does not map cleanly onto the GDPR controller/processor split. The central actor is the personal information processor — defined in Article 73 as any organisation or individual that independently determines the purposes and means of processing. Despite the word "processor", this role is functionally closer to the GDPR controller. Where one party processes on another's behalf under a contract, PIPL speaks of entrusted processing (Article 21): the entrusted party must process only as agreed, must not re-entrust without consent, and must return or delete the data when the arrangement ends. Where two or more processors jointly determine purposes and means, Article 20 requires them to agree their respective rights and obligations, and they bear joint and several liability for harm. Reading "processor" as the GDPR processor is a frequent and consequential misreading.

Consent — and the distinctive separate-consent requirement

Where processing rests on consent, Article 14 requires that consent be given voluntarily and explicitly, on a fully informed basis. If the purpose, the method, or the category of personal information changes, fresh consent must be obtained. Article 15 gives the individual the right to withdraw consent and requires the processor to provide a convenient means to do so. Article 16 prohibits refusing products or services because an individual declines or withdraws consent — unless the processing is genuinely necessary to provide that product or service.

PIPL's most distinctive feature is the separate-consent requirement. For certain higher-risk processing, ordinary bundled consent is not enough; the individual must give a discrete, specific consent to that particular activity. Separate consent is required to provide personal information to another processor (Article 23), to publicly disclose personal information (Article 25), to process sensitive personal information (Article 29), and to transfer personal information outside China (Article 39). A single all-purpose consent checkbox does not satisfy these requirements. Each separate-consent trigger must be surfaced to the individual on its own terms, with its own disclosures.

Before processing, Article 17 requires the processor to inform the individual — truthfully, accurately, completely, in a conspicuous manner and in clear language — of the processor's identity and contact information, the purpose and method of processing, the categories of personal information and the retention period, and the means by which the individual can exercise their rights. Where any of these matters changes, the individual must be notified.

Sensitive personal information — a higher bar, defined by harm

Article 28 defines sensitive personal information by reference to the consequences of its misuse: information that, once leaked or unlawfully used, could easily lead to infringement of personal dignity or harm to personal or property safety. The article gives examples — biometric data, religious belief, specific identity, medical and health information, financial accounts, and whereabouts — and expressly includes the personal information of minors under the age of 14. A processor may handle sensitive personal information only where it has a specific purpose and sufficient necessity, and only where it applies strict protective measures.

Separate consent is required to process sensitive personal information (Article 29), and Article 30 adds an extra notification layer: the processor must additionally inform the individual of the necessity of processing the sensitive information and the impact on the individual's rights and interests. For minors under 14, Article 31 requires the consent of a parent or other guardian and requires the processor to adopt special processing rules. These are cumulative requirements, not alternatives — sensitive-information processing engages the necessity test, the separate consent, the enhanced notice, and a mandatory impact assessment under Article 55 simultaneously.

Cross-border transfers — a mechanism on top of consent

PIPL treats the export of personal information as a distinct regulated act. Article 39 requires separate consent for any transfer outside China, together with specific notice of the overseas recipient's identity and contact details, the purpose and method of processing, the categories of personal information, and how the individual can exercise their rights against the overseas recipient. Separate consent alone is not sufficient, however. Article 38 requires the processor also to satisfy at least one of three principal export mechanisms: passing a security assessment organised by the CAC; obtaining certification from a specialised body in accordance with CAC provisions; or concluding a contract with the overseas recipient on the CAC's standard-contract template. International treaties to which China is a party may provide an alternative route.

Article 40 imposes data localisation on critical information infrastructure operators and on processors whose volume of processed personal information reaches a CAC-specified threshold: such data collected and generated in China must be stored in China, and any genuinely necessary export must pass the CAC security assessment unless a regulation provides otherwise. Article 41 separately restricts the provision of China-stored personal information to foreign judicial or law-enforcement authorities without approval from the competent Chinese authority. Throughout, the processor remains responsible under Article 38 for ensuring the overseas recipient meets PIPL's protection standard.

Individual rights — a defined catalogue

Chapter IV sets out the rights of individuals. Article 44 establishes the right to know about and to decide on the processing of one's personal information, and to limit or refuse processing by others, subject to legal exceptions. Article 45 gives the right to access and obtain a copy of one's personal information, to be provided in a timely manner, and adds a portability right: where an individual requests transfer of their personal information to a processor they designate, the processor must provide the means where CAC conditions are met. Article 46 provides the right to correction and supplementation of inaccurate or incomplete information.

Article 47 sets out the circumstances in which a processor must delete personal information on its own initiative — purpose achieved or no longer necessary, service discontinued or retention period expired, consent withdrawn, or processing in violation of law or agreement — and gives the individual a right to request deletion where the processor has not acted. Article 48 provides the right to request an explanation of the processing rules. Article 49 allows the near relatives of a deceased individual to exercise access, copy, correction and deletion rights for their own lawful interests, unless the deceased arranged otherwise. Article 50 requires the processor to establish a convenient mechanism to receive and handle rights requests, to give reasons for any refusal, and preserves the individual's right to sue in a People's Court if a request is refused. Article 24 separately governs automated decision-making, requiring transparency and fairness, prohibiting unreasonable differential treatment on price or terms, requiring a non-profiling option or an easy opt-out for marketing push, and giving individuals a right to an explanation and to refuse decisions made solely by automated means where the decision significantly affects their rights.

Processor obligations and governance

Chapter V sets the accountability obligations. Article 51 requires processors to adopt internal management systems and operating procedures, to classify personal information, to apply technical measures such as encryption and de-identification, to set and control access permissions and train staff, and to maintain a security-incident contingency plan. Article 52 requires processors above a CAC-specified volume threshold to designate a person in charge of personal information protection and to publish and file that person's contact details. Article 53 requires overseas processors caught by Article 3's extraterritorial scope to establish a dedicated agency or appoint a representative in China and to file its details with the regulator.

Article 54 requires processors to audit their processing for legal compliance on a regular basis. Article 55 requires a personal information protection impact assessment (PIPIA) — conducted in advance and recorded — before processing sensitive personal information, before automated decision-making, before entrusted processing or providing information to another processor or public disclosure, before any cross-border transfer, and before other processing with a significant impact on individuals. Article 56 defines the PIPIA's content and requires the report and processing record to be kept for at least three years. Article 57 requires that, where personal information has been or may be leaked, tampered with or lost, the processor immediately take remedial measures and notify the regulator and affected individuals, with the notice covering the categories and causes of the incident, the potential harm, the remedial and mitigation measures, and the processor's contact details. Article 58 imposes "gatekeeper" obligations on operators of important internet platforms with large user numbers and complex business — including an independent oversight body, platform rules, suspension of seriously non-compliant on-platform providers, and regular publication of a social-responsibility report.

Enforcement and penalties

Article 66 sets the sanctions regime. For a violation, the regulator may order rectification, issue a warning, confiscate unlawful gains and order the suspension or termination of an offending application; if rectification is refused, a fine of up to RMB 1 million may be imposed on the processor, with a fine of RMB 10,000 to RMB 100,000 on the directly responsible individuals. For serious violations, a provincial-level or higher regulator may impose a fine of up to RMB 50 million or up to 5% of the previous year's turnover, may order suspension of business or revocation of permits or licences, and may impose a fine of RMB 100,000 to RMB 1 million on responsible individuals — who may also be barred from senior or PI-protection roles for a period. Article 69 establishes a fault-based tort liability with a reversed burden of proof: where processing infringes personal-information rights and causes harm, the processor is liable in damages unless it can prove it was not at fault. Article 70 enables public-interest litigation by the procuratorate and designated organisations where a large number of individuals are affected.