Personal Information Protection Law (PIPL)
个人信息保护法. Effective 1 November 2021. China's counterpart to the GDPR — similar shape, different foundations.
In one line
A comprehensive personal-information statute: it lists when processing is lawful, gives individuals a set of rights, and puts cross-border transfers behind three gateways.
Who and what it governs
- Applies to processing personal information within China, and — under Article 3 — also to processing outside China that aims at providing products or services to people in China, or that analyses or assesses behaviour in China.
- "Personal information" means any information relating to an identified or identifiable natural person, excluding anonymised information.
Key provisions
| Topic | Provision |
|---|---|
| Lawful bases | Article 13 — consent; contract; HR management under labour rules; legal duty; public-health emergency; news reporting and public-opinion supervision within the law; other situations in law or regulation. There is no "legitimate interests" basis. |
| Sensitive personal information | Articles 28–29 — biometrics, religious belief, specific identity, medical and health, financial accounts, whereabouts, and the information of minors under 14. Requires separate consent and a specific-purpose justification. |
| Separate consent | A distinct statutory device, required for cross-border provision, disclosure to another processor, public disclosure, and sensitive data. |
| Individual rights | Articles 44–50 — knowledge, decision, access and copying, correction, deletion, portability, explanation of automated decisions, and a complaint route. |
| Personal information officer | Article 52 — processors reaching a volume threshold must designate a person responsible for protection. |
| Impact assessment | Articles 55–56 — required for sensitive data, automated decision-making, entrusting, disclosure, and cross-border transfers. |
| Breach notice | Article 57 — notify the authority and affected individuals. |
| Cross-border transfers | Article 38 — three gateways: security assessment, professional certification, or standard contract; plus the 2024 provisions relaxing thresholds. |
| Penalties | Article 66 — serious violations: up to RMB 50 million or 5% of prior-year turnover; suspension of service, business suspension and licence revocation; personal liability on responsible individuals. |
Relationship to other laws
- Sits alongside the Cybersecurity Law and the Data Security Law. The three are usually described as the "three pillars" of Chinese digital regulation.
- Implementing rules for cross-border flow: Provisions on Promoting and Regulating Cross-Border Data Flows (effective 2024-03-22).
Unverified / TODO
- Add the direct permalink to the PIPL text on the national law database — NPC Observatory: http://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html
- Confirm Article 3 wording for extraterritorial application
- Confirm the volume threshold behind Article 52
- Note the Cybersecurity Law amendment's effective date — confirmed 2026-01-01 (decision adopted 2025-10-28); PIPL is unaffected by it