China PIPL: Complete Compliance Guide for Foreign Companies (2026)

China’s Personal Information Protection Law (PIPL, 个人信息保护法) came into effect on 1 November 2021, becoming the country’s first national-level legislation dedicated entirely to personal data protection. For any foreign company that collects, processes, or transfers the personal information of individuals in mainland China, whether from inside or outside the country, the PIPL creates binding obligations.

Key takeaways

• The PIPL has applied since November 1, 2021, including to companies outside China that process the personal information of people in China to offer them products or services or to analyze their behavior (Art. 3).
• Processing needs one of seven legal bases (Art. 13); unlike the GDPR, legitimate interests is not one of them.
• Separate consent is required for sensitive personal information, sharing with another processor, public disclosure and transfers abroad.
• Transfers abroad go through a CAC security assessment, a standard contract or a certification, depending on volume and sensitivity, with exemptions since March 2024.
• Serious violations can bring fines of up to RMB 50 million or 5% of the previous year’s turnover, and up to RMB 1 million for each directly liable person.

This guide explains what the PIPL requires, how it compares to the GDPR, what it means for cross-border data transfers, and what practical steps foreign companies should take to achieve compliance. For the technical side of a website or app in China, such as hosting and the ICP filing, see our China website compliance consulting.

What Is the PIPL?

The PIPL was enacted on 20 August 2021 by the 30th Session of the Standing Committee of the 13th National People’s Congress, and came into force on 1 November 2021. It forms part of a trio of major Chinese data laws alongside the Cybersecurity Law (effective June 2017) and the Data Security Law (effective September 2021), which together create a comprehensive regulatory framework for data governance in China.

The official Chinese text of the PIPL is published on the National People’s Congress website, which also provides an official English translation (for reference). A widely cited academic translation is also maintained by the DigiChina project at Stanford University.

PIPL vs GDPR: Key Similarities and Differences

The PIPL draws heavily on the EU’s General Data Protection Regulation (GDPR) in its structure and intent. Companies already compliant with GDPR will find much of the PIPL familiar, but there are important differences that require specific attention.

	PIPL (China)	GDPR (EU)
Effective date	1 November 2021	25 May 2018
Extraterritorial reach	Yes: applies to processing outside China that targets Chinese residents	Yes: applies to processing outside EU that targets EU residents
Legal bases for processing	Seven bases: consent, contract or HR management, legal duties, emergencies, news reporting in the public interest, information already made public, other cases set by law; no legitimate interests basis	Six bases
Consent standard	Informed, voluntary, explicit; separate consent required for sensitive data and cross-border transfers	Freely given, specific, informed, unambiguous
Individual rights	Access, correction, deletion, portability, withdrawal of consent, restriction of automated decisions	Similar rights, plus right to object
Cross-border transfers	Three mechanisms: security assessment, standard contract, or certification (with volume thresholds)	Adequacy decision, SCCs, BCRs, or derogations
Data localization	Required for Critical Information Infrastructure Operators (CIIOs) and large-scale processors	No general localization requirement
Penalties	Up to RMB 50 million or 5% of annual revenue; individual fines up to RMB 1 million	Up to EUR 20 million or 4% of global annual turnover
DPO equivalent	Personal Information Protection Officer required for certain processors	DPO required for certain processors

The most significant practical difference for foreign companies is China’s cross-border data transfer framework, which is more prescriptive than GDPR and has seen significant regulatory updates in 2023 and 2024.

Who Does the PIPL Apply To?

The PIPL applies to any organization or individual that processes the personal information of natural persons within mainland China. Like the GDPR, it also has extraterritorial reach: processing activities conducted outside China still fall under the PIPL if they involve providing products or services to individuals in China, or analyzing and evaluating the behavior of individuals in China.

Key implication for foreign companies: if your website, app, or e-commerce platform is accessible by users in mainland China and you collect their data, the PIPL applies to you, regardless of where your servers are located. If you operate a website or app hosted in mainland China, which requires an ICP filing, PIPL compliance is mandatory.

The Hong Kong Privacy Commissioner (PCPD) has also published a useful overview of the PIPL specifically aimed at businesses operating across the border.

The PIPL distinguishes between two types of processing actors:

• Personal Information (PI) Handler: the entity that determines the purposes and means of processing. Equivalent to a “data controller” under GDPR.
• Entrusted Party: an entity that processes PI on behalf of a PI Handler, under instruction. Equivalent to a “data processor” under GDPR. Entrusted parties must act within the scope authorized by the PI Handler and cannot process PI for their own purposes.

Key Definitions

Personal Information (PI)

Under PIPL Art. 4, personal information is any information, whether electronically or otherwise recorded, that relates to an identified or identifiable natural person. This includes names, ID numbers, addresses, phone numbers, biometrics, location data, IP addresses, and behavioral data. Anonymized information that cannot be reversed is excluded.

Sensitive Personal Information (SPI)

SPI is a subset of PI that, if disclosed or misused, could cause harm to individuals’ security or dignity (PIPL Art. 28). It includes:

• Biometric characteristics (fingerprints, facial recognition data, DNA)
• Religious beliefs and specific identity details
• Medical and health records
• Financial account details
• Individual location tracking data
• Personal information of minors under the age of 14

Processing SPI requires a clear purpose, substantial necessity, stricter protective measures, and in most cases explicit separate consent from the individual (PIPL Art. 29-31).

Legal Bases and Consent

PIPL Art. 13 lists seven lawful bases for processing PI. They are close to the GDPR’s, with one notable difference: the PIPL has no “legitimate interests” basis.

1. Individual consent
2. Necessity for the conclusion or performance of a contract, or HR management
3. Necessity for performing a legal duty or obligation
4. Necessity in response to a public health emergency or to protect vital interests
5. Processing within a reasonable scope for news reporting, media supervision and other activities in the public interest
6. Processing within a reasonable scope of personal information that the individual has made public, or that has been lawfully made public
7. Any other circumstance prescribed by law or regulation

Consent requirements

When consent is the legal basis, it must be freely given, specific, and informed. Individuals must be clearly notified of the PI Handler’s identity, the purposes and methods of processing, and their rights. Consent must be obtained separately (independent of other agreements) in the following cases:

• Processing sensitive personal information
• Providing PI to a third party
• Publishing PI publicly
• Processing PI outside China (cross-border transfer)
• Using images or identification data collected in public places for any purpose other than public security

Automated decision-making does not require separate consent, but it must be transparent and fair, and individuals can refuse a decision made only by automated means when it significantly affects their rights (PIPL Art. 24).

Individuals have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.

Rights of Individuals

Under the PIPL, individuals whose data is processed (data subjects) have the following rights:

• Right to know and decide: individuals must be informed about processing activities and can restrict or refuse processing.
• Right of access and copy: individuals can request access to and copies of their PI held by a handler.
• Right to correction: individuals can request correction of inaccurate or incomplete PI.
• Right to deletion: handlers must delete PI when the processing purpose has been achieved, the retention period has expired, consent has been withdrawn, or processing violates laws.
• Right to portability: individuals can request that their PI be transferred to another PI Handler they designate.
• Right regarding automated decisions: individuals can request explanation of automated decisions that significantly affect their rights, and reject decisions based solely on automated processing.
• Rights of deceased individuals: close family members may exercise the rights of deceased individuals for legitimate personal interests.

Cross-Border Data Transfers

Cross-border data transfers are one of the most complex and frequently updated areas of PIPL compliance. Any transfer of personal information collected in China to a recipient outside mainland China requires one of three approved mechanisms, depending on the volume and sensitivity of the data.

Key regulations governing cross-border transfers (updated through 2025):

• PIPL (effective November 2021)
• Measures for the Standard Contract for Cross-border Transfers of Personal Information (effective June 2023)
• Provisions on Promoting and Regulating Cross-border Data Flow (effective March 2024)
• Regulation on Network Data Security Management (effective January 2025)

The Three Transfer Mechanisms

Mechanism	When required	Timeline
CAC Security Assessment	Critical Information Infrastructure Operators (CIIOs); transfers of important data; transfers of personal information of more than 1 million individuals; transfers of sensitive personal information of more than 10,000 individuals	~60 working days; valid 3 years
Standard Contract (SCC)	Non-CIIOs transferring non-sensitive personal information of 100,000 to 1 million individuals; or sensitive personal information of fewer than 10,000 individuals	15 working days to file; contract must be CAC-approved template
Personal Information Protection Certification	Same thresholds as Standard Contract; voluntary mechanism issued by CAC-accredited certification bodies	As required by certification institution; valid 3 years

Exemptions

Transfers are exempt from the above mechanisms when the volume of non-sensitive personal information transferred since 1 January of the current year is fewer than 100,000 individuals, provided no important data is involved. Additional exemptions cover transfers necessary for cross-border contract performance (such as international e-commerce, logistics, payments, travel bookings, or visa applications) and HR transfers under lawful employment arrangements. Specific consent from individuals remains required for all cross-border transfers regardless of which mechanism or exemption applies.

Is There a Whitelist or Blacklist?

China’s CAC has not published a formal adequacy whitelist equivalent to the GDPR’s. Countries or regions that have signed mutual recognition agreements with China may benefit from simplified procedures, but no general adequacy determination framework exists yet.

Compliance Obligations for Organizations

PI Handlers must implement the following measures regardless of the scale of their processing activities:

• Privacy notice: inform individuals before or at the time of collection about the identity of the PI Handler, purposes and methods of processing, categories of PI collected, retention period, and individual rights.
• Lawful basis: identify and document the legal basis for each processing activity.
• Data minimization: collect only PI that is directly necessary for the stated purpose. Retention periods must be the minimum necessary.
• Security measures: implement technical and organizational measures including data classification, encryption, de-identification, access controls, security training, and incident response plans.
• Personal Information Protection Impact Assessment (PIPIA): required before processing sensitive PI, before cross-border transfers, before providing PI to third parties, and before using PI for automated decision-making. The assessment must document processing purposes, potential risks, and protective measures.
• Record-keeping: PI Handlers that process PI of more than 1 million individuals must maintain detailed records of processing activities and may be required to appoint a Personal Information Protection Officer (PIPO) based in China.
• Third-party management: when engaging an Entrusted Party, a written agreement must specify the purpose, methods, and categories of PI to be processed, protective measures, and respective obligations.

Special Requirements for Minors

Processing the PI of minors under 14 requires separate consent from the parent or legal guardian. PI Handlers that target services at minors must establish specific PI protection rules for this category.

Special Requirements for Internet Platforms

PIPL Art. 58 imposes additional obligations on providers of “important internet platform services” (broadly, large-scale platforms). These include establishing an independent data protection oversight body, regularly publishing social responsibility reports on PI protection, and ceasing to provide services to PI Handlers that seriously violate laws or regulations.

Penalties

The PIPL introduces some of the most significant penalties in China’s data compliance framework:

• For organizations: suspension of business, confiscation of illegal gains and, in serious cases, fines of up to RMB 50 million or up to 5% of the previous year’s turnover (PIPL Art. 66).
• For individuals directly responsible: fines of up to RMB 1 million and prohibition from serving as directors, supervisors, data protection officers, or other senior management roles.
• Serious violations: authorities may order business suspension or revoke operating licenses in the most serious cases.

Enforcement is coordinated by the Cyberspace Administration of China (CAC) and sector-specific regulators. Individuals whose rights are violated may also pursue civil claims for compensation, and the burden of proof lies with the PI Handler to demonstrate compliance.

Practical Steps for Foreign Companies in China

For foreign companies with websites, apps, or e-commerce operations targeting mainland Chinese users, PIPL compliance typically requires the following steps:

1. Map your data flows. Identify all personal information you collect from Chinese users, where it is stored, how it is processed, and whether it is transferred outside China.
2. Update your privacy notice. Ensure your privacy policy or notice meets PIPL requirements: clear identity of the PI Handler, purposes, legal bases, retention periods, and how individuals can exercise their rights. This must be available in Chinese for a Chinese audience.
3. Establish a lawful basis for each processing activity. Consent is not always required, but where it is, your consent mechanisms must meet PIPL standards.
4. Assess your cross-border transfer position. Determine which mechanism applies to your transfers (security assessment, standard contract, or certification) based on the volume and sensitivity of the data you transfer.
5. Implement technical security measures. Encryption, de-identification, access controls, and incident response plans are mandatory, not optional.
6. Set up local representation. A company outside China that falls under the PIPL because it offers products or services to people in China, or analyzes their behavior, must set up a specialized agency or designate a representative in China, and report their contact details to the authorities (PIPL Art. 53). Processors that reach the volume set by the CAC must also designate a person in charge of personal information protection (Art. 52).

Customer data often lives in a CRM: if you build a CRM that fits China, decide early where its data is stored and whether it leaves the country, since that choice drives your transfer obligations.

What Should You Do Next?

Start with the data map of step 1: it tells you which of these rules apply to you, from consent to cross-border transfers. PIPL compliance takes work, particularly for companies with cross-border data flows or those running GDPR and PIPL compliance programs at the same time.

For the technical side of a website or app for China, from hosting to the ICP filing, the next step is our ICP license and China hosting consulting. For clients requiring in-depth legal and technical compliance support, QPSoftware works with TekID, specialists in regulatory compliance including PIPL, GDPR, and the Chinese Cybersecurity Law. Contact us to discuss your situation.

Frequently Asked Questions