China Personal Information Protection Law (PIPL)

Why does it matter?

The PIPL is closest to the GDPR in structure but differs in its legal bases, its consent rules and its cross-border mechanisms. It makes consent a defined, revocable act, sets prior impact assessments for named activities, and attaches fines of up to RMB 50 million or 5 percent of the prior year's revenue for grave violations (Article 66).

Key benefits include:

• Seven legal bases, not open-ended

Handling is allowed only on a listed basis, such as consent, contract or HR necessity, statutory duty, emergencies, lawful public-interest reporting or information the person made public (Article 13).

• Separate consent for sensitive acts

Separate consent is required for sensitive personal information, sharing with another handler and sending data abroad (Articles 23, 29 and 39).

• Three routes for exports

Data goes abroad after a CAC security assessment, certification by a specialized body, or a standard contract with the foreign recipient (Article 38).

• Impact assessment is mandatory

A prior assessment is needed for sensitive data, automated decision-making, entrusted handling, sharing or disclosure, and exports, with reports kept at least three years (Articles 55 and 56).

• Real penalties

Grave violations can draw a fine of up to RMB 50 million or 5 percent of prior-year revenue and business suspension (Article 66).

How does it work?

The PIPL's principles are legality, propriety, necessity and good faith (Article 5), a clear and reasonable purpose with minimum collection (Article 6), openness (Article 7), data quality (Article 8) and accountability for security (Article 9). Every activity needs one of the legal bases in Article 13, and consent must be voluntary, explicit and informed, with a convenient way to withdraw it (Articles 14 and 15).

Before handling, the handler gives notice of its identity and contact details, the purpose, methods, categories and retention period, and how individuals exercise their rights (Article 17). Individuals have rights to know and decide, access and copy, correct, delete, request explanations of rules and, where conditions are met, transfer data to another handler (Articles 44 to 50). Close relatives can exercise some rights for a deceased person (Article 49).

Governance duties include internal management systems, categorized data management, technical safeguards such as encryption and de-identification, staff training and incident response plans (Article 51), a personal information protection officer above a threshold (Article 52), a representative in China for offshore handlers (Article 53), and regular compliance audits (Article 54). Handlers notify authorities and individuals of actual or possible leaks, distortion or loss (Article 57).

Key Elements

• Legal bases and consent (Articles 13 to 15)

The seven bases are consent; contract or HR necessity; statutory duty; emergencies; reasonable news reporting in the public interest; information the person disclosed or that was lawfully made public; and other cases in law. Consent must be voluntary and explicit and must be renewed when purpose, method or categories change.

• Sensitive personal information and minors (Articles 28, 29 and 31)

Sensitive information is information whose leak or misuse could easily harm dignity or personal or property safety, including biometrics, religious beliefs, specific identity, medical and health data, financial accounts, location tracking and the data of minors under 14. Handling requires a specific purpose, real necessity, strict protection and separate consent. For minors under 14, a parent or guardian consents and the handler adopts specialized rules.

• Automated decision-making (Article 24)

Automated decisions must be transparent and fair, with no unreasonable price or trading-term discrimination. Automated marketing offers an option that does not use personal characteristics or an easy way to refuse. Individuals may ask for an explanation of decisions with major impact and may refuse decisions made solely by automated means.

• Cross-border transfers (Articles 38 to 40)

A handler sending data abroad meets one condition: a security assessment by the CAC, certification by a specialized body, a standard contract with the foreign recipient, or another condition set by law. It also tells individuals about the recipient and obtains separate consent. Critical information infrastructure operators and handlers over a volume threshold store domestically collected data in China, and exports need a state security assessment.

• Impact assessments and records (Articles 55 and 56)

A prior personal information protection impact assessment covers whether purposes and methods are lawful and necessary, the impact and risks to individuals, and whether safeguards are effective and proportionate. Assessment reports and handling records are kept at least three years.

• Large platforms and penalties (Articles 58 and 66)

Platforms with very large user bases build a compliance system with an independent oversight body and publish social responsibility reports. Violations bring correction orders, confiscation of gains and app suspension, with fines up to RMB 1 million for refusing to correct and up to RMB 50 million or 5 percent of prior-year revenue for grave cases.

What does it cover?

The PIPL applies to the handling of personal information of natural persons within China, and to handling outside China when the aim is to offer products or services to people in China or to analyze or assess their behavior (Article 3). Personal information is information recorded electronically or otherwise that relates to an identified or identifiable natural person, excluding anonymized information (Article 4). Offshore handlers within the extraterritorial scope establish a dedicated entity or appoint a representative in China (Article 53).

What are its objectives?

The PIPL aims to protect personal information rights, standardize handling and promote its reasonable use (Article 1).

Protect individuals' rights and interests in their personal information.

Require a legal basis, clear purpose and minimum scope for all handling.

Give individuals rights to know, decide, access, correct, delete and obtain explanation.

Impose special rules on sensitive information, minors, automated decisions and large platforms.

Control exports of personal information through assessment, certification or standard contract.

Hold handlers accountable through audits, impact assessments and substantial penalties.

Framework in Context

The PIPL is one of China's three main data and cyber laws with the Cybersecurity Law and the Data Security Law. It governs personal information specifically, while the Data Security Law governs data of every kind and the Cybersecurity Law governs network operations. Many of its concepts echo the GDPR, but it has its own list of legal bases and its own cross-border routes.

Common Framework Mappings

Organizations map PIPL to other major privacy and security frameworks to harmonize requirements, simplify compliance, manage cross-border data flows, and align controls and governance across jurisdictions.

Mapped frameworks include:

APEC Privacy Framework

California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)

General Data Protection Regulation (GDPR)

Health Insurance Portability and Accountability Act (HIPAA)

ISO/IEC 27701

Lei Geral de Proteção de Dados (LGPD)

NIST Privacy Framework

Personal Data Protection Act (Singapore)