Meet China's PIPL obligations with evidence you can stand behind

PIPL is the Personal Information Protection Law of the People's Republic of China, the country's comprehensive data protection law. It took effect on 1 November 2021 and governs how organisations collect, use, store, share and transfer personal information. It sets legal bases for processing, stricter rules for sensitive personal information, individual rights, security duties and conditions for sending data outside China. It is often compared with the EU GDPR.

Any organisation that processes personal information within China must comply with PIPL. It also applies outside China when an organisation processes the personal information of people in China to provide them with products or services, to analyse or assess their behaviour, or in other circumstances set by law. Overseas processors in scope must set up a dedicated office or appoint a representative in China and report their details to the authorities.

Serious PIPL violations can lead to fines of up to RMB 50 million or 5% of the previous year's turnover, along with suspension of business, confiscation of illegal income and revocation of licences. The person directly in charge can be fined between RMB 100,000 and 1 million and barred from senior roles. Less serious breaches attract corrective orders, warnings and fines of up to RMB 1 million. Civil and criminal liability can also apply.

Under Article 38, personal information can only be sent outside China once a recognised route is met: passing a CAC security assessment, obtaining personal information protection certification, or signing the CAC standard contract with the overseas recipient. Organisations must also tell individuals about the transfer and obtain separate consent where required, and complete an impact assessment. Critical information infrastructure operators and high-volume processors must store data in China and pass a security assessment.

PIPL and GDPR share core ideas such as legal bases, data minimisation, individual rights and impact assessments, but PIPL is stricter in several areas. It has no legitimate interests basis, requires separate consent for sensitive data, public disclosure and many transfers, and imposes state-controlled routes for cross-border transfers. Enforcement sits with the Cyberspace Administration of China rather than independent data protection authorities. GDPR work gives you a strong head start.

To comply with PIPL, map the personal information you process, confirm a legal basis under Article 13 and update privacy notices and consent flows. Then put in place internal policies, access controls, encryption and staff training under Article 51, run impact assessments where Article 55 requires them, and set up a cross-border transfer route. Regular compliance audits, incident response plans and a process for handling individuals' requests complete the programme.

Yes, for larger processors. Article 52 requires processors that handle personal information above the volume set by the Cyberspace Administration of China to appoint a personal information protection officer, publish their contact details and report them to the authorities. Separately, overseas processors in scope must appoint a representative or office in China under Article 53. Smaller organisations should still assign clear internal responsibility for personal information protection.

Yes. OneClickComply supports PIPL today, mapping one set of controls across PIPL, GDPR and ISO 27001 so evidence collected once counts towards each. The platform automates evidence collection, generates policies from your environment, monitors security controls and manages vendor risk for entrusted processors. Our in-house audit team offers guidance through Ask an Auditor. OneClickComply helps you prepare and evidence compliance but does not replace legal advice on Chinese law.