China's Regulatory Landscape at a Glance
China's framework combines PIPL with the Cybersecurity Law and the Data Security Law, together with a substantial and evolving body of implementing measures, national standards, and network data regulations. Data is also classified by importance, and the rules that apply to a given dataset depend on that classification as much as on whether it is personal information.
The requirements applicable to an organisation depend on its activities, sector, processing operations, and regulatory status.
- Jurisdiction
- China
- Primary data protection framework
- Personal Information Protection Law (PIPL), effective 1 November 2021
- Related statutes
- Cybersecurity Law (2017) and Data Security Law (effective September 2021)
Key Regulations in China
Personal Information Protection Law (PIPL)
PIPL took effect on 1 November 2021 and is China's comprehensive personal information statute. It applies to the handling of personal information within China, and extraterritorially where handling outside China is for the purpose of providing products or services to natural persons in China, or to analyse or assess their behaviour.
PIPL is consent-centric. Although it sets out other lawful bases, it does not contain a general legitimate interests basis equivalent to the GDPR's, which materially narrows the options available for routine commercial processing.
Depending on applicability, organisations may need to address:
- A lawful basis for each handling activity, often consent.
- Separate consent for specified activities, including transfers abroad and sensitive personal information.
- Notice given to individuals before handling begins.
- Personal information protection impact assessments for defined activities.
- Appointment of a personal information protection officer where thresholds are met.
- A dedicated entity or representative in China for offshore handlers.
- A route for any cross-border transfer.
- Security measures, classification, and breach notification.
The absence of a general legitimate interests basis is the single most important structural difference from the GDPR and should be addressed before mapping an existing programme across.
Separate Consent
PIPL requires consent to be obtained separately, rather than bundled, for a defined set of activities. These include providing personal information to another handler, disclosing personal information publicly, handling sensitive personal information, transferring personal information outside China, and using images or identification information collected in public places for other purposes.
Sensitive personal information is defined broadly and includes biometric data, religious belief, specific identity, medical health, financial accounts, individual location tracking, and the personal information of minors under fourteen.
Organisations relying on consent may need to consider:
- Which activities require a separate consent rather than a general one.
- Whether consent is genuinely voluntary and can be refused without losing the service.
- The requirement to obtain fresh consent when purposes or methods change.
- Parental consent for the personal information of minors under fourteen.
- That individuals may withdraw consent and handlers must provide a means to do so.
Bundled consent is a recurring enforcement theme in China, particularly in mobile application reviews.
Cross-Border Transfer Routes
Transferring personal information out of China requires one of three statutory routes: a security assessment organised by the Cyberspace Administration of China, certification by an accredited body, or the filing of a standard contract in the form issued by the CAC. Which route applies depends on the nature of the handler and the volume and sensitivity of the data.
Measures adopted in 2024 to promote and regulate cross-border data flows introduced exemptions and raised the thresholds at which the heavier routes apply, easing the position for lower-volume transfers. The specific thresholds and exemptions have been adjusted more than once.
Organisations transferring data out of China may need to consider:
- Which of the three routes applies to the transfer.
- Whether a current exemption removes the need for a route.
- The personal information protection impact assessment each route requires.
- Filing obligations with the provincial cyberspace administration.
- Whether the data includes important data, which engages a separate regime.
- Separate consent from individuals for the transfer.
The thresholds and exemptions in this area are the most frequently revised part of Chinese data law. Confirm the current figures against official sources before designing a transfer architecture; they are deliberately not quoted here.
Data Security Law and Data Classification
The Data Security Law, effective September 2021, governs data activities generally rather than only personal information. It establishes a classified and tiered protection system under which data is categorised by its importance to national security, the economy, and the public interest.
Important data and core data attract heightened obligations, including risk assessments and restrictions on export. Catalogues identifying important data are developed by sector and region, which means classification can differ between industries.
Organisations handling data in China may need to consider:
- Whether any of their data falls within an important data catalogue.
- Periodic risk assessments and reporting for important data.
- Restrictions on transferring important data abroad.
- Obligations when responding to foreign law enforcement requests for data.
- Internal data classification aligned to the sectoral catalogues.
The Data Security Law applies to data beyond personal information, so a programme scoped only to personal information will not cover it.
Cybersecurity Law and Network Data Rules
The Cybersecurity Law, effective June 2017, imposes network security obligations on network operators and heightened duties on operators of critical information infrastructure, including a data localisation requirement. Network data security management regulations adopted subsequently consolidate and extend obligations across network data handling.
Organisations in scope may need to consider:
- Whether they are a network operator or an operator of critical information infrastructure.
- Data localisation duties applying to critical information infrastructure operators.
- Multi-level protection scheme requirements for network security.
- Real-name registration and log retention obligations.
- Incident response and reporting duties.
Designation as an operator of critical information infrastructure is made by sector regulators, so an organisation may not know its status without engaging with them.
Sectoral and Application-Level Rules
A large body of subordinate measures and national standards gives practical content to the statutes, covering areas such as mobile application personal information collection, automotive data, facial recognition, algorithmic recommendation, and generative artificial intelligence services.
Sectoral considerations may include:
- Minimum necessary collection rules for mobile applications.
- Automotive and connected vehicle data requirements.
- Restrictions on facial recognition and biometric collection.
- Algorithmic recommendation filing and transparency duties.
- Requirements applying to generative artificial intelligence services.
National standards are formally voluntary but are treated as the practical compliance benchmark by regulators and in app review processes.
Who Needs to Comply With Chinese Data Protection Law?
PIPL and the related statutes may apply to:
Organisations in China
Personal information handlers established in China that determine the purposes and means of handling personal information.
International companies
Handlers outside China providing products or services to natural persons in China, or analysing or assessing their behaviour.
Offshore handlers needing representation
Organisations within PIPL's extraterritorial scope, which must establish a dedicated entity or appoint a representative in China and file its details.
Entrusted processors
Service providers handling personal information under an agreement, which may not exceed the agreed purposes and must return or delete data at the end.
Critical information infrastructure operators
Organisations designated by sector regulators, which face data localisation and heightened security duties.
Employers
Organisations handling employee data, where human resources management is a recognised basis but is narrowly construed.
The precise obligations depend on the organisation's role, processing activities, size, risk profile, and territorial scope.
Understanding Your Obligations Under PIPL
Lawful Basis for Handling
Each handling activity requires a basis under PIPL. The available bases include consent, necessity for a contract to which the individual is a party, human resources management under lawfully adopted labour rules, statutory duties, public health emergencies, news reporting in the public interest, and handling of information already lawfully disclosed.
There is no general legitimate interests basis, so activities that would rely on it under the GDPR usually need consent or contractual necessity in China.
Notice and Transparency
Before handling personal information, individuals must be told in clear and easily understood language the identity and contact details of the handler, the purposes and methods of handling, the categories of information, the retention period, and how they may exercise their rights.
Impact Assessments
A personal information protection impact assessment must be carried out before defined activities, including handling sensitive personal information, automated decision-making, entrusting handling to another party, providing information to third parties, disclosing information publicly, and transferring information abroad. Records must be kept for at least three years.
The three-year record retention requirement for impact assessments is specific and frequently missed.
Protection Officer and Governance
Handlers processing personal information above volume thresholds set by the Cyberspace Administration must appoint a person responsible for personal information protection and publish their contact details. Internal management systems, operating procedures, classified management, and security training are required.
Handlers meeting the threshold of providing important internet platform services face additional duties, including publishing social responsibility reports.
Breach Response
Where a leak, distortion, or loss of personal information occurs or may have occurred, the handler must immediately take remedial measures and notify the relevant authority and the affected individuals, with notification covering the categories of information, causes, potential harm, and measures taken.
Notification to individuals may be withheld only where measures taken effectively avoid the harm, and the authority may still require it.
Cross-Border Transfer
A transfer abroad requires one of the three statutory routes unless an exemption applies, together with separate consent from the individual, an impact assessment, and notice of the overseas recipient's identity, contact details, purposes, methods, and the means of exercising rights against them.
Individual Rights Under PIPL
PIPL gives individuals a number of rights over their personal information. Depending on the circumstances, these may include:
Right to Know and Decide
Individuals have the right to know about and decide on the handling of their personal information, and to restrict or refuse handling by others.
Access and Copy
Individuals may consult and copy their personal information, and request its transfer to another handler where conditions set by the authority are met.
Correction and Completion
Individuals may request correction or completion of inaccurate or incomplete personal information.
Deletion
Individuals may request deletion where the purpose is achieved, consent is withdrawn, handling is unlawful, or the retention period has expired.
Withdrawal of Consent
Where handling is based on consent, individuals may withdraw it and the handler must provide a convenient means to do so.
Automated Decisions
Individuals may refuse decisions made solely by automated means that significantly affect their rights, and may request an explanation.
Handlers must establish a convenient mechanism for accepting and handling requests, and must give reasons where a request is refused.
China's Regulatory Timeline
China built its data framework through three statutes enacted over five years.
- June 2017
Cybersecurity Law in Force
The Cybersecurity Law introduced network security obligations and data localisation duties for operators of critical information infrastructure.
- September 2021
Data Security Law in Force
The Data Security Law established the classified and tiered data protection system, covering data generally rather than only personal information.
- November 2021
PIPL in Force
The Personal Information Protection Law took effect, introducing comprehensive personal information rules and extraterritorial application.
- March 2024
Cross-Border Flows Eased
Provisions on promoting and regulating cross-border data flows introduced exemptions and raised thresholds for the heavier transfer routes.
Important: implementing measures, thresholds, and exemptions in this area change frequently, and this page deliberately avoids quoting current threshold figures. Confirm the position against official sources before acting.
Data Protection Authorities in China
The Cyberspace Administration of China (CAC) is the principal authority for personal information and network data. It issues implementing measures and standard contract forms, organises security assessments for cross-border transfers, conducts app and platform reviews, and takes enforcement action including ordering rectification, suspension, and removal of applications.
Other authorities have significant roles depending on sector and activity, including the Ministry of Industry and Information Technology for telecommunications and applications, the Ministry of Public Security, the State Administration for Market Regulation, and sector regulators that designate critical information infrastructure and maintain important data catalogues.
Enforcement is distributed across central and provincial bodies, and provincial cyberspace administrations handle many filings in practice.
Penalties for Non-Compliance
PIPL provides a two-tier administrative penalty structure. For ordinary violations, authorities may order rectification, issue warnings, confiscate unlawful gains, and suspend or terminate the service, with fines on the organisation and on the individuals directly responsible. For grave violations, fines may reach RMB 50 million or 5% of the preceding year's turnover, together with suspension of relevant business, cessation of operations for rectification, and revocation of permits or business licences.
Individual accountability is a distinctive feature: persons directly responsible for a grave violation may be fined personally and may be prohibited from holding director, supervisor, senior management, or personal information protection officer positions for a period. Violations are also recorded in the social credit system, and the Data Security Law and Cybersecurity Law carry their own separate penalties. Serious conduct can attract criminal liability.
How RegulatoryBridge Supports Compliance in China
RegulatoryBridge helps organisations assess China's regulatory requirements and coordinate their compliance activities with wider international programmes.
PIPL Compliance Assessment
Review your processing activities, legal bases, notices, policies, governance arrangements, and operational controls to identify potential gaps.
Protection Officer and Representative Assessment
Review whether a personal information protection officer is required for your processing volumes, and whether an offshore handler must establish a dedicated entity or appoint a representative in China.
Data Subject Rights
Review request-handling processes, response timelines, privacy notices, and related documentation against the requirements applicable to you.
Breach Response and CAC Notification
Evaluate breach assessment procedures, escalation responsibilities, CAC notification readiness, and coordination between privacy, security, and legal teams.
International Data Transfers
Assess cross-border transfers against the three statutory routes, the current exemption thresholds, and the impact assessment and filing each route requires.
Sectoral Compliance Coordination
Help organise requirements across PIPL, the Cybersecurity Law, the Data Security Law, network data regulations, and sectoral rules.
Regulatory Monitoring
Monitor relevant developments and review compliance plans when legislation, CAC guidance, or enforcement decisions change.
The scope of support is tailored to the organisation's activities, risk profile, and applicable legal requirements.
Our Approach to China Compliance
- 01
Identify Applicable Requirements
Assess your organisation's activities, role in processing personal data, industry, and connections to China.
- 02
Map Regulatory Obligations
Identify applicable provisions, relevant authorities, effective dates, and sector-specific requirements.
- 03
Conduct a Gap Assessment
Review existing policies, notices, consent mechanisms, contracts, security controls, and operational processes.
- 04
Develop a Compliance Roadmap
Prioritise remediation activities and establish owners, milestones, documentation requirements, and implementation plans.
- 05
Maintain Ongoing Readiness
Review regulatory developments, reassess relevant obligations, and update compliance processes when required.
Frequently Asked Questions About China Compliance
Need PIPL support in China?
We support your China representative arrangements, cross-border transfer routes, and CAC interactions - so your global product team doesn't have to.