PIPL (China)
Also known as: PIPL, Personal Information Protection Law, China privacy law, China data protection law
China's Personal Information Protection Law (PIPL) governs how organizations collect, use, and transfer personal information of people in China, including companies based abroad.
While it resembles GDPR on paper, with consent rules, individual rights, and big fines, it sits inside a broader national security framework. That's why its data export rules matter as much as its privacy protections.
PIPL (China), explained at three levels
At home
If you live in China, the PIPL gives you rights over your personal information, such as knowing how it's used, getting a copy, and asking for corrections or deletion. Apps must ask for your consent for many types of data use.
At work
Businesses that handle personal information of people in China, including foreign companies selling there, must follow the PIPL. That includes getting consent, protecting data, and following special rules before sending data out of China.
At home
The PIPL requires 'separate consent' for certain activities, such as sharing your data with another company, processing sensitive information like health or financial data, or sending it abroad. You can also refuse marketing based on automated profiling and ask for an explanation of automated decisions that significantly affect you.
At work
Exporting personal information from China requires one of several mechanisms: a CAC security assessment (for large volumes or critical information infrastructure operators), the CAC standard contract with filing, or certification. Foreign companies without a presence in China may need a local representative. Personal information impact assessments are required for many activities.
At home
Penalties can reach 50 million yuan or 5% of the previous year's revenue, and responsible individuals can face personal fines and bans from management roles. In my view, the personal liability provisions are a powerful deterrent, more so in practice than the corporate fines.
At work
The PIPL interacts with the Data Security Law's concept of 'important data,' which is defined by sector catalogues and can trigger export restrictions regardless of whether personal information is involved. Multinationals often localize data in China and minimize exports, rather than relying on transfer mechanisms. Regular compliance audits became mandatory for many handlers under measures effective in 2025, adding another recurring obligation.
Real-world examples
At home
Lena, a Canadian working in Shanghai, downloaded a ride-hailing app. It asked for separate consent before sharing her location data with a partner company. Under the PIPL, she could refuse that sharing and still use the core service.
At work
Jerome is the IT director at a Canadian manufacturer with a factory in China. To send employee data to headquarters for payroll analysis, his team signed the CAC standard contract, completed a personal information impact assessment, and filed it with local authorities.
How it compares
| feature | PIPL (China) | GDPR |
|---|---|---|
| Maximum fine | 50 million yuan or 5% of annual revenue | €20 million or 4% of global turnover |
| Data export rules | Security assessment, standard contract, or certification | Adequacy, SCCs, BCRs, or derogations |
| Regulator | Cyberspace Administration of China and others | National data protection authorities |
| Broader framework | Linked to Data Security Law and national security | Standalone fundamental rights framework |
| Personal liability | Fines and bans for responsible individuals | Generally on the organization |
PIPL and GDPR share privacy concepts, but the PIPL is also a data sovereignty law.
For analysts
For any China operation, I'd start with a data flow map focused on exports. Deciding what data needs to leave China at all is usually the biggest compliance lever, and it often shows that much of the data never needed to move.
History & origin
China built its data governance framework in layers. The Cybersecurity Law took effect in 2017, the Data Security Law on September 1, 2021, and the PIPL, adopted on August 20, 2021, came into force on November 1, 2021. The Cyberspace Administration of China (CAC) leads enforcement. Rules for exporting personal information followed: security assessments for large or sensitive transfers, a standard contract effective June 2023, and certification. In March 2024, the CAC relaxed some export requirements, exempting certain routine transfers. In my opinion, the PIPL is best understood as two laws in one: a consumer privacy law aimed at domestic tech giants, and a data sovereignty law aimed at everyone else.