China's Personal Information Protection Law (PIPL) reaches far beyond Chinese companies, and most foreign organisations find out when a transfer of HR, customer or log data to a global system turns out to need a filing, a contract or a security assessment. The PIPL has applied since 1 November 2021, but the rules that make it work in practice arrived later: the Cyberspace Administration of China (CAC) rewrote the cross-border thresholds in March 2024, the Network Data Security Management Regulations took effect on 1 January 2025, compliance audits became mandatory from 1 May 2025, and outbound certification measures applied from 1 January 2026. This guide covers scope, legal bases and consent, the three transfer routes and when each applies, security and audit duties, enforcement, and what the law means for automated systems and the machine identities that move data. It is for security, privacy and engineering leads at multinationals and executives judging exposure; for cross-jurisdiction comparison see the Global Privacy Regulatory Map.
Key takeaways
- Extraterritorial by design: Article 3 covers handling outside China where the purpose is to provide goods or services to people in China or to analyse or assess their behaviour, and Article 53 then requires a dedicated entity or representative in China.
- Consent is one of seven bases, but separate consent is everywhere: sharing with another handler, public disclosure, sensitive personal information and every outbound transfer each need their own separate consent when consent is the basis.
- Thresholds now decide the transfer route: under the March 2024 Provisions, fewer than 100,000 individuals (non-sensitive) since 1 January is exempt, 100,000 to under 1 million needs a standard contract or certification, and 1 million or more (or 10,000 sensitive) needs a CAC security assessment.
- Security duties are explicit and audited: Article 51 lists classification, encryption, de-identification and access limits; handlers of more than 10 million individuals must run a compliance audit at least every two years.
- Penalties scale with turnover and reach individuals: serious violations can bring fines up to RMB 50 million or 5% of the prior year's turnover, plus personal fines and job bans for responsible managers.
Scope: who and what is covered
The PIPL regulates the handling of personal information of natural persons. "Handling" covers the whole lifecycle: collection, storage, use, processing, transmission, provision, disclosure and deletion. Anonymised information falls outside the law; de-identified (pseudonymised) information does not.
| Scope element | PIPL position | Article |
|---|---|---|
| Territorial | Handling inside mainland China, and handling outside China to provide goods or services to individuals in China, to analyse or assess their behaviour, or in other cases set by law | Art. 3 |
| Personal information handler | An organisation or individual that independently decides purposes and methods (the GDPR "controller" equivalent) | Art. 73 |
| Entrusted party | Processes on a handler's behalf under an agreement; must not exceed the agreed purpose | Art. 21 |
| Sensitive personal information | Biometrics, religious belief, specific identity, medical health, financial accounts, location tracking, and all information of minors under 14 | Art. 28 |
| Overseas handlers | Must set up a dedicated entity or appoint a representative in China and report it to regulators | Art. 53 |
| Critical information infrastructure operators (CIIOs) | Must store personal information collected in China inside China; exports need a security assessment | Art. 40 |
| Large platforms | Extra governance duties, including an independent oversight body and social responsibility reports | Art. 58 |
The PIPL sits alongside the Cybersecurity Law (CSL) and the Data Security Law (DSL), which governs "important data". The Network Data Security Management Regulations (State Council Decree No. 790) tie the three together and, in Article 62(8), define a large platform as 50 million or more registered users or 10 million or more monthly active users.
Key obligations
Legal bases and consent
Article 13 gives seven legal bases: consent; contract or lawful HR management necessity; statutory duties; public health or emergency protection of life and property; news reporting in the public interest; reasonable handling of information already made public; and other cases set by law. There is no general "legitimate interests" basis, which is the single biggest difference from the GDPR for multinationals that rely on it for analytics, security monitoring and fraud scoring.
| Activity | Consent requirement where consent is the basis | Article |
|---|---|---|
| Any processing on consent | Informed, voluntary and explicit; renewed when purpose, method or categories change; withdrawable | Art. 14, 15 |
| Providing data to another handler | Notice of recipient identity, purpose and categories plus separate consent | Art. 23 |
| Public disclosure | Separate consent | Art. 25 |
| Images from public-space cameras and identity recognition devices | Only for public security; other uses need separate consent | Art. 26 |
| Sensitive personal information | Separate consent, or written consent where other law requires | Art. 29 |
| Minors under 14 | Parent or guardian consent and dedicated handling rules | Art. 31 |
| Outbound transfer | Notice of the overseas recipient and how to exercise rights against it, plus separate consent | Art. 39 |
Treat "separate consent" as a distinct action, not a privacy policy clause. Decree 790 (Art. 21 and 22) adds lists of personal information collected and shared, and bars repeated consent requests after a refusal.
Automated decision-making
Article 24 requires transparency and fair results in automated decision-making, prohibits unreasonable differential treatment in trading conditions such as price, requires an easy way to switch off personalised targeting and marketing, and gives individuals the right to an explanation and to refuse decisions made solely by automated means that significantly affect their rights. Article 42 of the 2025 regulations adds that personalised push services must let users delete their profiling tags.
Individual rights
Articles 44 to 50 cover knowing, deciding and refusing; access, copy and portability; correction; deletion (Art. 47 also requires deletion on the handler's own initiative when the purpose is achieved or consent is withdrawn); explanation of handling rules; and rights of close relatives of the deceased. Refusals must be reasoned, and individuals may sue.
Security, governance and impact assessments
- Security measures (Art. 51): internal management rules and operating procedures, classified management of personal information, encryption and de-identification, restricted operational access and staff training, and incident response plans.
- Personal information protection officer (Art. 52): required for handlers that reach volume thresholds set by the CAC; contact details must be published and reported.
- Personal information protection impact assessment, PIPIA (Art. 55 and 56): required before handling sensitive information, automated decision-making, entrusting processing, providing or disclosing to others, and outbound transfers. It must cover lawfulness and necessity, risks to individuals and whether safeguards are proportionate, and reports must be kept for at least three years.
- Incidents (Art. 57): immediate remediation and notice to regulators and individuals covering data types, cause, possible harm, remedies and a contact point; individual notice may be skipped where harm is effectively prevented, unless regulators require it.
For how to run the assessment itself, see the DPIA Guide.
Cross-border transfers
Article 38 lists the routes: a CAC security assessment, personal information protection certification, a standard contract with the overseas recipient, or other conditions set by law. The CAC's Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Order No. 16, effective 22 March 2024) now set when each route applies and prevail over the earlier assessment and standard contract measures where they conflict.
| Situation (cumulative since 1 January of the current year) | Route | Source |
|---|---|---|
| Data needed for a contract with the individual (cross-border shopping, remittances, travel bookings, visas), cross-border HR management, or emergencies | Exempt from all three mechanisms | Provisions Art. 5 |
| Non-CIIO, fewer than 100,000 individuals, no sensitive information | Exempt | Provisions Art. 5(4) |
| Non-CIIO, 100,000 to under 1 million individuals, or under 10,000 individuals' sensitive information | Standard contract (filed) or certification | Provisions Art. 8 |
| Non-CIIO, 1 million or more individuals, or 10,000 or more individuals' sensitive information | CAC security assessment | Provisions Art. 7 |
| Any CIIO, or any important data | CAC security assessment | Provisions Art. 7 |
| Data outside a free trade zone negative list | Exempt | Provisions Art. 6 |
- Standard contract: the contract must follow the CAC annex without conflicting changes, and must be filed with the provincial CAC within 10 working days of taking effect together with the PIPIA report (Standard Contract Measures, Art. 6 and 7). Changes in purpose, scope, recipient processing or the recipient country's law trigger re-assessment and re-filing (Art. 8).
- Certification: the Measures for Personal Information Outbound Certification (CAC and SAMR, effective 1 January 2026) apply to the same middle tier, prohibit splitting transfers to avoid an assessment, and issue certificates valid for three years.
- Security assessment: applied for through the provincial CAC; an approved result is valid for three years and an extension can be requested from 60 working days before expiry (Provisions Art. 9).
- Exemptions do not remove other duties: notice, separate consent and the PIPIA still apply to exempt transfers (Provisions Art. 10).
Important data is only in scope for assessment declaration once regulators have notified or published it as such (Provisions Art. 2), but Decree 790 Art. 29 requires processors to identify and declare it under published catalogues. See the Data Sovereignty and Residency Guide for architecture options.
Timeline and current status
Status checked on 24 October 2026 against the NPC Observer legislative record and CAC publications. No amendment to the PIPL itself was found; the changes below are implementing rules and a related law.
| Date | Instrument | Effect |
|---|---|---|
| 20 August 2021 | PIPL adopted by the NPC Standing Committee | Text fixed |
| 1 November 2021 | PIPL in force (Art. 74) | All obligations apply |
| 1 June 2023 | Standard Contract Measures (CAC Order No. 13) | Contract template and 10 working day filing |
| 22 March 2024 | Provisions on Promoting and Regulating Cross-Border Data Flows | New exemptions and thresholds; overrides earlier thresholds |
| 1 January 2025 | Network Data Security Management Regulations (Decree No. 790) | Privacy policy lists, 10 million user duties, crawler and generative AI provisions |
| 1 May 2025 | Personal Information Protection Compliance Audit Measures | Mandatory audits, at least every two years above 10 million individuals |
| 1 June 2025 | Facial Recognition Technology Application Security Management Measures | Filing at 100,000 individuals, on-device storage by default |
| 1 January 2026 | Personal Information Outbound Certification Measures; amended Cybersecurity Law | Certification route formalised; higher CSL fines and wider extraterritorial reach |
Thresholds have changed twice since 2022: check any figure in an older memo against the current CAC text.
Enforcement and penalties
- Ordinary violations (Art. 66): correction orders, warnings, confiscation of unlawful gains and suspension or termination of offending apps; a fine of up to RMB 1 million if the handler refuses to correct; RMB 10,000 to 100,000 for directly responsible individuals.
- Serious violations (Art. 66): fines up to RMB 50 million or 5% of the previous year's turnover, suspension of business, revocation of licences; RMB 100,000 to 1 million for responsible individuals, who may also be barred from director, supervisor, senior manager or PI protection officer roles for a period.
- Civil liability (Art. 69): the handler is liable for harm unless it proves it was not at fault.
- Restricted recipients (Art. 42): the CAC can list foreign organisations that may not receive personal information.
- Regulator-ordered audits: on significant risk or an incident, regulators may order an audit by a professional institution at the handler's cost.
The defining enforcement case is DiDi. On 21 July 2022 the CAC fined DiDi RMB 8.026 billion under the CSL, DSL and PIPL, citing among other things about 107 million items of excessively collected passenger facial recognition data and about 57.8 million national ID numbers stored in plaintext; the chair and the president were each fined RMB 1 million personally.
What it means for AI agents and non-human identities
The PIPL does not mention AI agents, but service accounts, integration tokens, ETL jobs and AI agents now move most personal information across borders, and each is a transfer channel the law counts.
- Every outbound credential is a transfer route: an API key that lets a global CRM, analytics platform or AI service pull data held in China counts towards the cumulative thresholds. Inventory which non-human identities can read China-resident personal information and where their calls terminate. See the Agentic AI Identity Guide.
- Threshold counting needs telemetry: only flow logs tied to identities (which job, which token, how many distinct individuals) show where you stand against the cumulative thresholds.
- Automated decisions are regulated: an agent that scores, prices or rejects individuals triggers Article 24 rights and a PIPIA under Article 55. Keep a decision log with the inputs used so an explanation can be given.
- Least privilege is a legal duty: Article 51 requires restricted access, so agent and service account scopes over sensitive categories should be narrow, time-bound and reviewed.
- Crawlers and generative AI: Decree 790 requires an assessment before automated collection such as crawling (Art. 18) and training data security for generative AI providers (Art. 19). Labelling and service filing rules for generative AI are covered in the China Generative AI Measures and AI Labelling Rules Guide.
Compliance steps
- Confirm applicability: map China entities and Article 3 offshore processing; appoint the Article 53 representative where needed.
- Build the data and flow inventory: categories, sensitive flags, systems, and every flow leaving China with its source identity (user, service account, agent), destination and recipient. Use the Data Classification Guide to tag sensitive and important data.
- Assign a legal basis per purpose: replace any reliance on legitimate interests; use contract or HR necessity where genuine and design separate consent flows where consent is needed.
- Count and choose the transfer route: compute cumulative individuals per category since 1 January, apply the Article 5 exemptions first, then select exemption, standard contract, certification or assessment. Block splitting across entities to stay under thresholds.
- Run PIPIAs: for transfers, sensitive data, automated decisions and entrusted processing; keep reports three years and refresh them when flows change.
- Implement Article 51 controls: encryption at rest and in transit, de-identification for analytics, role and service account access limits, logging of access to sensitive categories.
- Prepare incident handling: a playbook that produces the Article 57 notice content and meets any sector reporting deadlines; Decree 790 Art. 10 sets 24 hours for vulnerabilities affecting national security or the public interest. See the Data Breach Notification Checklist for the wider notice process.
- Schedule audits: above 10 million individuals, a compliance audit at least every two years; below that, run periodic self-audits so a regulator-ordered audit holds no surprises.
- Test and roll back: pilot consent flows and transfer controls in one product first, and keep the old data path until the filed contract or certificate covers the new one.
Decision guidance
| Profile | Likely route | Trade-off |
|---|---|---|
| Small foreign company, staff data only | HR necessity exemption | Must still give notice, get separate consent where consent is used, and run a PIPIA |
| Mid-size consumer business, 100,000 to 1 million users | Standard contract or certification | Contract is faster for one recipient; certification suits intra-group transfers to many entities |
| Large platform or CIIO | Security assessment, or local hosting | Assessment takes months and lasts three years; localising processing can remove the transfer entirely |
Detection, measurement and framework mapping
- Monitor: egress from China-hosted systems by identity and destination, bulk exports of sensitive categories, new integrations touching China data, and consent withdrawals that should trigger deletion.
- Metrics: cumulative individuals transferred per category against each threshold; percentage of outbound flows mapped to a filed mechanism or exemption; PIPIAs current versus flows in production; deletion requests closed within the target period; non-human identities with access to sensitive categories that have a named owner.
| PIPL duty | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Legal basis and purpose (Art. 13, 14) | PT-2, PT-3 | GV.OC-03 | A.5.34 |
| Consent and notice (Art. 17, 23, 29, 39) | PT-4, PT-5 | GV.OC-03 | A.5.34 |
| PIPIA (Art. 55, 56) | RA-8 | GV.OC-03 | A.5.34 |
| Data inventory and classification (Art. 51) | SI-12 | ID.AM-07 | A.5.12 |
| Access restriction (Art. 51) | AC-6 | PR.AA-05 | A.5.15 |
| Encryption (Art. 51) | SC-28 | PR.DS-01 | A.8.24 |
| Recipients and entrusted parties (Art. 21, 38) | SA-9 | GV.SC-05 | A.5.14 |
| Deletion (Art. 47) | SI-12.3 | PR.DS-01 | A.8.10 |
| Incident notice (Art. 57) | IR-6 | RS.CO-02 | A.5.26 |
Common failure patterns
- Relying on legitimate interests: GDPR-style records of processing carried over to China with no valid Article 13 basis for analytics or monitoring.
- Bundled consent: one tick box covering sharing, sensitive data and transfer, which does not meet the separate consent articles.
- Forgotten machine paths: backups replicated to a foreign region, support tooling, observability platforms and AI assistants that receive personal information without appearing in the transfer inventory.
- Filing and forgetting: standard contracts not re-filed after a new recipient, new purpose or longer retention, which Article 8 of the Standard Contract Measures requires.
Practitioner checklist
- Decide whether Article 3(2) applies and, if so, appoint the Article 53 representative.
- Record a legal basis per purpose and remove any reliance on legitimate interests.
- Implement separate consent for sharing, disclosure, sensitive data and transfers where consent is the basis.
- Inventory every outbound flow with its source identity, including service accounts and AI agents.
- Count individuals per category cumulatively from 1 January and pick the route from the 2024 Provisions.
- File standard contracts within 10 working days and re-file on material change.
- Keep PIPIA reports and transfer records for at least three years.
- Encrypt and restrict access to sensitive categories, especially biometrics and ID numbers.
- Plan the biennial compliance audit if you handle more than 10 million individuals.
Standards and references
- DigiChina, Stanford University: Translation of the Personal Information Protection Law of the PRC
- Cyberspace Administration of China: Provisions on Promoting and Regulating Cross-Border Data Flows
- Cyberspace Administration of China: Measures on the Standard Contract for Outbound Transfer of Personal Information
- Cyberspace Administration of China: Measures for Personal Information Outbound Certification
- Cyberspace Administration of China: Measures for Personal Information Protection Compliance Audits
- State Council of the PRC: Network Data Security Management Regulations
- Cyberspace Administration of China: Measures for the Security Management of Facial Recognition Technology Applications
- DigiChina, Stanford University: Chinese Authorities Announce Fine in DiDi Case
Related NHI Mgmt Group resources: Global Privacy Regulatory Map · China Generative AI Measures and AI Labelling Rules Guide · Biometrics Guide · Global AI Regulation Map. This guide summarises China's Personal Information Protection Law and its main implementing rules as of October 2026 and is not legal advice.