China PIPL: Personal Information Rules and Cross-Border Transfers

The PIPL, China's Personal Information Protection Law, has governed the processing of personal information in China since 1 November 2021. It is often compared with the GDPR, but it has distinctive features: separate consent for certain processing, strict control of transfers outside China through state-defined routes, a local representative requirement for some foreign processors, and close links to China's data security and cybersecurity laws. PIPL compliance matters for any company with Chinese users, customers or employees, or whose engineering or support teams access data from China.

The Cyberspace Administration of China (CAC) has added detailed rules since 2021, including relaxed thresholds for cross-border transfers in March 2024, compliance audit measures in 2025, and a certification route for transfers from 1 January 2026. This guide explains scope, legal bases, rights, duties, transfers and penalties, and what SaaS and IT companies should do.

What is the PIPL?

The PIPL is one of three laws forming China's data governance framework, with the Cybersecurity Law (2017) and the Data Security Law (2021). It regulates "personal information processors", the equivalent of GDPR controllers, and "entrusted parties" that process on their behalf. Personal information is any information relating to an identified or identifiable natural person recorded electronically or otherwise, excluding anonymised information. Processing includes collection, storage, use, refinement, transmission, provision, disclosure and deletion.

Implementing rules include the Network Data Security Management Regulations, in effect since 1 January 2025, and CAC measures on security assessments, standard contracts, certification and compliance audits. Many national standards (GB/T standards) give technical detail.

Who must comply?

Under Article 3, the PIPL applies to processing within China, and to processing outside China of personal information of natural persons within China where the purpose is:

• to provide products or services to people in China;
• to analyse or assess the behaviour of people in China; or
• other circumstances provided by laws and regulations.

Foreign processors within this scope must establish a dedicated entity or appoint a representative in China to handle personal information protection matters, and report the name and contact details to the authorities (Article 53).

Is the PIPL mandatory or voluntary?

Mandatory. Certification exists under the PIPL, but it is a route for cross-border transfers and evidence of good practice, not a substitute for compliance.

Legal bases and consent

Article 13 allows processing only where one of these applies:

1. the individual's consent;
2. necessity to conclude or perform a contract with the individual, or for human resources management under lawful labour rules and collective contracts;
3. necessity to perform statutory duties or obligations;
4. necessity to respond to public health emergencies or protect life, health and property in emergencies;
5. news reporting and public opinion supervision in the public interest, within a reasonable scope;
6. processing information already lawfully disclosed by the individual or otherwise, within a reasonable scope;
7. other circumstances provided by law.

There is no general legitimate interests basis, which makes consent more central than under the GDPR. Consent must be voluntary, explicit and fully informed, and individuals can withdraw it. Separate consent is required for processing sensitive personal information, providing personal information to another processor, publicly disclosing it, transferring it outside China, and using images collected by public surveillance equipment for purposes other than public security.

Sensitive personal information

Sensitive personal information is information that, once leaked or illegally used, can easily harm dignity or endanger personal or property safety. It includes biometrics, religious beliefs, specific identities, medical health, financial accounts, location tracking, and all personal information of minors under 14. Processing requires a specific purpose, sufficient necessity, strict protection measures, separate consent, and notice of the necessity and impact. Processing data of children under 14 requires parental consent and dedicated rules.

Individual rights

Individuals have rights to know and decide, to restrict or refuse processing, to access and copy, to portability where CAC conditions are met, to correct and supplement, to deletion, and to an explanation of processing rules. Article 24 regulates automated decision-making: it must be transparent and fair, must not apply unreasonable differential treatment in transaction terms, individuals must be able to opt out of personalised push marketing, and they can request explanation and refuse decisions made solely by automated means that significantly affect them. Close relatives can exercise certain rights over a deceased person's information. Processors must set up convenient mechanisms for requests and explain refusals.

Processor duties

• Notice of processor identity, purposes, methods, categories, retention, and how to exercise rights, before processing.
• Internal management: policies, classification, encryption and de-identification, access controls, training, and incident response plans.
• Personal information protection officer where processing reaches CAC thresholds; the Network Data Security Management Regulations require one for processors handling the information of more than one million individuals.
• Personal information protection impact assessment before processing sensitive information, automated decision-making, entrusting processing, providing data to others, public disclosure, cross-border transfer, and other processing with significant impact. Records must be kept for at least three years.
• Compliance audits: CAC measures effective 1 May 2025 require regular audits, and processors handling the information of more than 10 million individuals must audit at least every two years. Regulators can also order audits.
• Entrusted processing: contracts must define purpose, period, method, categories, protection measures and the parties' rights and duties, and the processor must supervise the entrusted party.
• Large platforms have extra duties, such as independent oversight bodies and social responsibility reports.

Security incidents

Under Article 57, when a leak, tampering or loss of personal information occurs or may occur, the processor must immediately take remedial measures and notify the authorities and affected individuals of the categories involved, causes, possible harm, remedial measures, steps individuals can take and contact information. Notification to individuals may be skipped where measures effectively avoid harm, unless authorities decide otherwise. Separate national cybersecurity incident reporting measures set short reporting times for significant incidents.

Cross-border transfers

Under Article 38, a processor transferring personal information outside China must use one of three routes, in addition to separate consent, notice and an impact assessment:

1. CAC security assessment, mandatory for critical information infrastructure operators and for larger volumes.
2. Standard contract concluded with the overseas recipient using the CAC template and filed with the provincial CAC.
3. Personal information protection certification by an accredited institution, under certification measures in force from 1 January 2026.

The Provisions on Promoting and Regulating Cross-Border Data Flows (March 2024) set thresholds for processors that are not critical information infrastructure operators, counted from 1 January of the current year:

Volume transferred	Route required
Non-sensitive personal information of fewer than 100,000 individuals	Exempt from the three routes (other PIPL duties still apply)
Non-sensitive information of 100,000 to 1 million individuals, or sensitive information of fewer than 10,000	Standard contract or certification
Non-sensitive information of more than 1 million individuals, or sensitive information of more than 10,000	CAC security assessment

The provisions also exempt transfers necessary to conclude or perform a contract with the individual, such as cross-border shopping, travel booking and payments; cross-border human resources management under lawful rules; emergencies protecting life and property; and data collected outside China and passed through it. Free trade zones may publish negative lists. Data classified as "important data" under the Data Security Law requires a security assessment regardless of volume. Remote access from abroad to data stored in China counts as a transfer. Because thresholds and exemptions have changed several times since 2022, check the latest CAC rules before relying on any of them.

Localisation

Critical information infrastructure operators and processors handling personal information above CAC-set volumes must store personal information collected in China within China, and transfer it abroad only after a security assessment. Requests from foreign judicial or law enforcement bodies for data stored in China require approval from Chinese authorities.

Penalties

For ordinary violations, authorities can order correction, issue warnings, confiscate unlawful gains, suspend or terminate apps, and fine up to RMB 1 million, with fines on responsible individuals. For serious violations, fines reach RMB 50 million or 5 percent of the previous year's turnover, with possible suspension of business, revocation of licences, and fines of RMB 100,000 to 1 million plus bans from senior roles for responsible persons. Violations are recorded in credit files, and civil liability applies with a reversed burden of proof on fault. The Cybersecurity Law was amended with effect from 1 January 2026, strengthening penalties under the wider framework.

How the PIPL fits with China's other data laws

The PIPL rarely applies alone. The Data Security Law classifies data by importance and requires organisations to identify "important data", which faces stricter export controls and risk assessments regardless of whether it is personal. The Cybersecurity Law sets network security obligations, including the multi-level protection scheme for information systems and extra duties for critical information infrastructure operators. The Network Data Security Management Regulations, in effect since 2025, connect these laws with practical requirements on data classification, incident reporting, cross-border transfers and platform rules. For a technology company, this means a China privacy project usually also involves system security grading, data classification and network security controls.

Across Asia, companies often manage the PIPL alongside India's DPDP Act and Singapore's PDPA. The PIPL is the strictest of the three on transfers and consent. A common approach is to build one regional privacy program, organised with the NIST Privacy Framework or ISO/IEC 27701, and then add China-specific controls for consent, data location and transfer filings.

How to comply, step by step

1. Confirm scope: Chinese users, targeting, employees or data stored in China.
2. Map personal information, sensitive data, purposes, bases and recipients, inside and outside China.
3. Design consent flows with separate consent where required.
4. Publish Chinese-language processing rules (privacy policy).
5. Run impact assessments for sensitive data, transfers and automated decisions.
6. Count cross-border volumes and choose the route: exemption, standard contract, certification or security assessment.
7. Appoint a representative in China if you are a foreign processor in scope, and a protection officer where thresholds apply.
8. Set incident response with immediate notification.
9. Plan compliance audits.
10. Review vendor contracts for entrusted processing.

Documentation you will need

• Processing rules (privacy policy) in Chinese.
• Records of consent and separate consent.
• Impact assessment reports kept at least three years.
• Cross-border transfer records, volumes, standard contract filings or certificates.
• Entrusted processing contracts.
• Security policies, classification and incident response plans.
• Compliance audit reports.
• Representative or officer appointments.

Common mistakes for SaaS and IT companies

• Treating remote support access from India or elsewhere to China-hosted data as not a transfer.
• Relying on legitimate interests, which the PIPL does not recognise.
• Bundling separate consent into general terms.
• Not counting transfer volumes from 1 January each year.
• Ignoring important data classification for industrial or geographic data.
• Using a GDPR policy translated into Chinese without PIPL-specific content.

Best practices, tools and technologies

• Host Chinese users' data in China where practical and minimise what leaves.
• Use regional data partitioning in application architecture.
• Log all cross-border access, including support sessions.
• De-identify data before analytics or transfer.
• Build consent management with separate consent toggles.
• Align controls with ISO/IEC 27701 and ISO/IEC 27001, alongside Chinese national standards.

We design region-aware architectures, consent records and access logging through our web application development and migration services.

PIPL compared with the GDPR

Topic	PIPL	GDPR
Legitimate interests	Not available	Available
Separate consent	Required for sensitive data, transfers, sharing and disclosure	Explicit consent for some special categories
Transfers	Security assessment, standard contract or certification, with volume thresholds	Adequacy, SCCs, BCRs and derogations
Localisation	Required for CIIOs and high-volume processors	None
Maximum fine	RMB 50 million or 5% of previous year's turnover	EUR 20 million or 4% of worldwide turnover

Real-world example

A European B2B SaaS with Chinese enterprise customers hosts their data in a mainland China cloud region. Its support team in India sometimes needs access. The company counts how many individuals' information is accessed from abroad each year, which stays under 100,000 non-sensitive records, so the transfer is exempt from the three routes; it still obtains separate consent through customers' notices, completes an impact assessment and logs every support session. When volumes grow, it plans a standard contract filing.

Next steps

1. Confirm whether PIPL applies.
2. Map data and transfer volumes.
3. Fix consent and processing rules.
4. Choose the cross-border route.
5. Plan impact assessments and audits.

Frequently asked questions

Does the PIPL apply to companies outside China?

Yes, when they process personal information of people in China to provide products or services to them or analyse their behaviour.

Does the PIPL allow legitimate interests?

No. It has no general legitimate interests basis.

What is separate consent?

Specific consent obtained apart from general consent, required for sensitive data, cross-border transfers, sharing with other processors and public disclosure.

What are the routes for transferring data out of China?

A CAC security assessment, a filed CAC standard contract, or certification, unless an exemption applies.

Are small transfers exempt?

Transfers of non-sensitive information of fewer than 100,000 individuals a year by non-CIIO processors are exempt from the three routes.

Is remote access from abroad a transfer?

Yes. Accessing data stored in China from outside China is treated as a cross-border transfer.

What are the maximum penalties?

Up to RMB 50 million or 5 percent of the previous year's turnover for serious violations.

Do foreign companies need a representative in China?

Foreign processors within the PIPL's extraterritorial scope must establish an entity or appoint a representative.

Is data localisation required?

For critical information infrastructure operators and processors above CAC-set volumes.

What counts as sensitive personal information?

Biometrics, religion, specific identities, health, financial accounts, location tracking and all information of minors under 14, among others.

How often are compliance audits needed?

Regularly, and at least every two years for processors handling information of more than 10 million individuals.