‍

The Personal Information Protection Law (PIPL) of the People's Republic of China, which came into effect on November 1, 2021, represents a significant milestone in the global data privacy landscape. Considered China's most comprehensive data privacy legislation to date, the PIPL establishes a stringent set of rules for the processing of personal information. It aligns with global standards like the European Union's General Data Protection Regulation (GDPR) but incorporates characteristics and nuances specific to the Chinese context, reflecting the fundamental pillars of cyber sovereignty and national security.

Prior to the PIPL, China's data protection regulatory landscape was fragmented, consisting of several laws and regulations such as the Cybersecurity Law (CSL) of 2017, the Data Security Law (DSL) of 2021, and the 2020 National Information Security Standards (Information Security Technology – Personal Information Security Specification). While these laws established basic principles and technical requirements, they lacked a unified and comprehensive legal framework dedicated exclusively to protecting personal data and the rights of data subjects.

PIPL’s enactment was driven by the rapid growth of the digital economy, increasing public concern over the collection and misuse of personal data by companies and government agencies, as well as the need to harmonize domestic regulations with international privacy trends. The law’s main objectives are:

‍

Main Objectives of PIPL

Protect rights and interests of individuals: ensure that personal information is processed fairly, transparently, and lawfully, and that individuals maintain meaningful control over their data. This includes right to access, correct, delete, and port their information.

Regulate personal data processing: establish clear rules and principles for the collection, storage, use, processing, transmission, provision, disclosure, and deletion of data, ensuring legality and data minimization.

Promote legitimate and orderly use of personal data: facilitate the development of the digital economy and technological innovation by ensuring data processing is conducted securely and ethically in compliance with the law, without unduly inhibiting the data flow necessary for commerce and services.

Ensure national security and the public interest: balance data protection with the country's security and development needs, particularly in critical sectors and for data classified as “important” or “core.”

‍

1. Key Definitions and data Categories

The PIPL introduced fundamental definitions and terms that are critical to its application and have significant practical implications for compliance. The main ones are outlined below:

‍

PIPL Terms and Definitions

Personal Data: refers to any information relating to an identified or identifiable natural person that is recorded by electronic or other means. This includes, but is not limited to, name, phone number, address, online identifiers (e.g., IP addresses, cookie IDs), location data, and biometric information. It is crucial to note that the PIPL excludes anonymized information, from which an individual cannot be identified and the data cannot be restored to its original state. However, pseudonymized data is still considered personal information.

Sensitive Personal Data: personal information that, if leaked or misused, could easily lead to personal discrimination or serious harm to an individual's personal or property safety. This category requires a significantly higher level of protection and explicit, separate consent. Examples include: Biometric data (e.g., fingerprints, facial recognition patterns, voiceprints).

Religious and philosophical beliefs.

Health status and medical history.

Financial accounts and transaction details.

Location and tracking data.

Sexual orientation.

Personal information of minors under 14 years of age, under parental consent.

The processing of sensitive personal information requires a more robust legal basis and a mandatory Data Protection Impact Assessment (DPIA).

Data Processing: encompasses a wide range of activities, including collection, storage, use, processing, transmission, provision, disclosure, and deletion of personal information. In essence, it refers to any operation performed on personal data, whether by automated or manual means.

Data Controller: refers to any organization or individual that independently determines the purposes and methods of processing personal information. The controller bears the primary responsibility for ensuring PIPL compliance.

Data Processor (Data Operator): while the PIPL does not explicitly define “processor” in the same way as the GDPR, it refers to entities that process data on behalf of a controller (e.g., cloud service providers, marketing agencies). The controller is obligated to supervise processors and ensure their compliance with PIPL obligations through clear contractual agreements.

‍

2. Extraterritorial Reach

The PIPL has notable extraterritorial reach, similar to the EU's GDPR and Brazil's LGPD, making it relevant to companies worldwide regardless of their physical location. Its scope can be conceptualized as follows:

An important requirement for foreign companies without a physical presence in China is that the PIPL mandates the designation of a dedicated representative or entity within the country to handle matters related to data protection. This representative acts as a point of contact for Chinese authorities and data subjects and is responsible for registering the company's information with regulatory agencies. Failure to appoint such a representative may result in significant penalties.

‍

3. Fundamental Principles

The PIPL establishes core principles for data processing, requiring controllers and processors to operate on lawful grounds and with transparency. It promotes a culture of “privacy by design” and “privacy by default.” The principles outlined by the PIPL are:

‍

PIPL Principles

Principle of Legality and Legitimacy: data processing must have a legal basis and a legitimate purpose. This means the collection and use of data must be justified for a valid reason, such as the performance of a contract or compliance with a legal obligation.

Minimum Necessity Principle: controllers should only collect personal information that is strictly necessary to achieve the stated purpose for processing. This prevents excessive and irrelevant data collection.

Principle of Consent: the PIPL requires explicit and voluntary consent from the individual for the processing of their personal information. Consent must be obtained in a clear and informed manner. However, note that consent is not the only legal basis for processing; other bases are discussed below.

Principle of Transparency and Notification: controllers are obligated to clearly inform individuals about the purpose, methods, and types of personal information being collected. Data subjects must be aware of how their data is being handled and have the right to access and correct it.

Principle of Quality and Accuracy: personal information must be accurate and kept up to date. Controllers and processors must take reasonable measures to ensure data quality and allow individuals to correct inaccuracies.

Principle of Accountability: controllers and processors are responsible for the security of the data they process. They must implement appropriate technical and organizational measures to protect data against unauthorized access, disclosure, alteration, or destruction. In the event of a data breach, the company must notify the relevant authorities and the affected individuals.

Principle of Storage Limitation: personal information should be retained only for as long as necessary to fulfill the purpose for which it was collected. Once the purpose is achieved, the data must be deleted or anonymized.

Principle of Integrated Security: although not explicitly named “privacy by design,” this principle is embedded in the PIPL. It requires that data security and protection measures be integrated into the design phase of products, services, and business activities from the outset, rather than being added as an afterthought.

‍

4. Legal Basis

Similar to the GDPR and LGPD, the PIPL establishes specific legal bases that legitimize the processing of an individual's personal information. Processing is permitted when:

‍

Legal Basis of PIPL

The individual has provided their consent.

It is necessary for the conclusion or performance of a contract to which the individual is a party, or for the implementation of human resources management in accordance with legally established labor policies and collective contracts.

It is necessary for the performance of a statutory duty or obligation.

It is necessary for responding to public health emergencies or for protecting the life, health, and property safety of an individual in an emergency.

It is for the purpose of carrying out acts such as news coverage and public opinion monitoring, and the processing of personal information is within a reasonable scope.

The personal information has been disclosed by the individual or has been otherwise lawfully disclosed, and is processed within a reasonable scope in accordance with this Law.

Other circumstances provided by laws or administrative regulations.

‍

5. Data Subject Rights

The PIPL grants data subjects a suite of rights over their personal information, empowering them to control how their data is used. Controllers are required to establish mechanisms to facilitate the exercise of these rights:

‍

Data Subject Rights in PIPL

Right to Access and Copy: individuals have the right to access and obtain a copy of their personal information held by a controller. Controllers must provide this information in a timely manner and in a readable format.

Right to Correction and Rectification: individuals may request the correction of any inaccurate or incomplete personal data. Controllers must make corrections without undue delay.

Right to Deletion: individuals can request the deletion of their data under specific circumstances, such as when the processing purpose has been achieved, when consent is withdrawn, or when the processing is unlawful. Controllers and processors must comply unless a legal basis for data retention exists (e.g., a legal obligation).

Right to Withdraw Consent: individuals may withdraw their consent at any time. Controllers must then cease processing based on that consent. The lawfulness of processing activities conducted prior to withdrawal remains unaffected.

Right to Data Portability: individuals may request the transfer of their data to another controller The PIPL mandates that controllers provide a means for portability, though the technical standards and formats are still being developed.

Right to Restrict and Refuse Processing: individuals have the right to restrict processing or to refuse processing for direct marketing, user profiling, or automated decision-making that significantly impacts their rights and interests.

Right to an Explanation: a particularly significant right under the PIPL, especially concerning algorithms and AI. Individuals can request an explanation of the rules governing the processing of their data, including the logic and rules used in automated decision-making (e.g., in recommendation systems or credit scoring). This aims to enhance the transparency and accountability of algorithmic systems.

‍

6. Key Obligations for Controllers and Processors

The PIPL imposes significant responsibilities on data controllers and processors, requiring a proactive and systematic approach to data protection. Key obligations include:

‍

Key Obligations for Controllers and Processors under the PIPL

Appointment of a Data Protection Officer or Representative (DPO): organizations that process large volumes of personal data (a threshold not yet precisely defined but implying significant commercial activity) must appoint a designated person or establish a team responsible for data protection. Foreign companies without a physical presence in China must appoint an in-country representative, registered with the authorities, to act as a point of contact. The DPO oversees compliance, acts as a liaison with public authorities, and advises the organization.

Conducting out DIPAs: mandatory prior to processing activities that pose a high risk to individuals' rights and interests. Examples include:

– Processing sensitive personal information.

– Transferring personal information overseas.

– Using automated decision-making that affects individuals' rights and interests.

– Processing large volumes of personal data.

– Any other data processing that may significantly impact individuals' rights and interests. The DPIA must identify risks, assess the necessity and lawfulness of processing, and outline measures to mitigate risks.

Implementation of Adequate Security Measures: controllers must adopt effective technical and organizational measures to protect personal data against unauthorized access, leakage, alteration, or destruction. This includes:

– Technical Measures: data encryption (in transit and at rest), anonymization/pseudonymization, role-based access control (RBAC), regular security audits, network monitoring, intrusion detection systems (IDS/IPS), and disaster recovery plans.

– Internal data protection policies, regular employee training, confidentiality agreements, vendor management (due diligence and contracts), and incident response plans.

Security Incident Response: in the event of a data breach (e.g., leak, loss), controllers must promptly notify the relevant regulatory authorities (primarily the Cyberspace Administration of China – CAC) and the affected individuals. Notifications must detail the incident's cause, the categories of data involved, the measures taken, and the steps individuals can take to mitigate potential harm.

Maintenance of Processing Records: controllers are required to maintain records of personal information processing activities, including data categories, purposes, legal bases, recipients, and security measures. These records must be kept for at least three years and be available for authorities to inspect.

‍

7. Cross-Border (International) Data Transfer

The PIPL imposes strict rules on transferring personal information outside of China, aiming to protect Chinese residents' data even when processed overseas. This is a particularly challenging area for multinational companies. To legitimize a cross-border transfer, one of the following conditions must be met:

‍

Conditions for Legitimizing Cross-Border Data Transfer in the PIPL

Passing a Security Assessment administered by CAC. This is mandatory for:

– Critical Information Infrastructure Operators.

– Controllers processing personal information above a certain volume (a precise threshold is not yet defined, but generally understood to be over 1 million individuals).

– Controllers transferring large volumes of sensitive personal information.

– Any other scenario authorities deem to affect national security or public interest. The assessment is rigorous and can be time-consuming, requiring a detailed analysis of offshore data security and recipient compliance.

Obtaining a Personal Information Protection Certification from an institution accredited by the CAC. This is a voluntary mechanism that can streamline compliance for some companies.

Signing Standard Contract with the overseas recipient, using the model contractual clauses published by the authorities. This is a common path for companies not subject to security assessment. The standard contract imposes obligations on foreign recipients to protect the data as per the PIPL.

Meeting other conditions stipulated by laws, administrative regulations, or by the CAC. This clause allows for flexibility for future regulatory developments.

Furthermore, regardless of the chosen mechanism, controllers must inform individuals of the overseas recipient's identity, contact details, processing purpose and methods, data categories, and their rights. Separate, explicit consent for the cross-border transfer must be obtained. Conducting a DPIA prior to any cross-border transfer is crucial to assess risks and ensure compliance.

‍

8. Supervision and Penalties

The PIPL is primarily enforced by the CAC and other relevant departments, e.g., the Ministry of Industry and Information Technology (MIIT) and the State Administration for Market Regulation (SAMR). Penalties for non-compliance are severe and designed to deter violations:

‍

PIPL Penalties

Warnings and Correction Orders: for minor or first-time violations, authorities may issue warnings, order corrections, or confiscate illegal gains.

Administrative Fines:

– For general or less serious violations: fines of up to 1 million RMB (approx. USD 140,000).

– For serious violations (e.g., illegal processing of sensitive data, refusal to correct violations after warning, causing major damage): fines of up to 50 million RMB (approx. USD 7 million) or 5% of the previous year's annual revenue (whichever is higher). This is among the highest percentage-based fines globally.

Suspension of Operations: suspension of business activities related to the non-compliant data processing, or suspension of mobile applications.

License Revocation: revocation of business or operational licenses, effectively halting operations in China

Personal Liability: individuals directly responsible (e.g., executives, DPOs) can be fined up to 1 million RMB and may be barred from holding data protection or senior management positions.

Legal Actions: data subjects can sue for losses resulting from PIPL violations. Furthermore, public interest litigation can also be initiated by prosecutors against organizations that violate the rights of a large number of individuals.

‍

9. Current Challenges Faced by Companies

Compliance with privacy laws always poses several challenges for companies in adapting to regulations in any country. Adapting to the PIPL is no exception, and the main challenges foreseen for companies include:

‍

Main Challenges for Companies

Ambiguity in Certain Provisions: while comprehensive, some areas lack precise definition, such as details on security assessment requirements for cross-border transfer, the thresholds for “large” data, and the interpretation of “big data” (which relates to the Data Security Law). Further clarity from implementing regulations and guidance is needed.

Compliance Complexity: for multinationals, harmonizing PIPL compliance with other regimes (like the GDPR or CCPA) is complex due to differences in requirements, terminology, and regulatory focus. For instance, the PIPL has a strong emphasis on national security and government control over data.

Compliance Costs: implementing robust security measures, conducting DPIAs, adapting consent mechanisms, re-engineering data flows, and hiring experts require significant investment in technology, personnel, and legal counsel.

Interpretation and Enforcement: how authorities like the CAC will interpret and enforce the law in practice, and the consistency of enforcement actions, remains a point of concern for businesses. There is a concern that the law’s  enforcement could be influenced by economic or political priorities.

Data Localization: while not a universal mandate by the PIPL, the stringent cross-border transfer rules, especially for important data, may lead many companies to store and process data within China to simplify their compliance burden.

‍

10. Overview

China's Personal Information Protection Law is a comprehensive and sophisticated piece of legislation that sets a new standard for data protection within the country. It reflects growing global awareness of privacy importance and aligns China with other jurisdictions possessing robust data laws, while incorporating unique elements reflective of its national priorities.

For any company operating in China or handling the data of Chinese citizens, the PIPL is a stringent legal requirement with significant consequences for non-compliance. Effective adaptation demands a deep understanding of its provisions and the implementation of robust technical and organizational measures underpinned by proactive data governance.

The PIPL represents a crucial step towards mature and responsible data governance in China, with profound implications for how data is handled in one of the world's largest digital markets. Companies should treat PIPL compliance as a strategic priority not merely to avoid penalties, but to build consumer trust, ensure long-term business continuity, and secure sustainable growth in an evolving regulatory landscape.