China PIPL

What it does

China's comprehensive personal information law: requires a legal basis (usually consent) for processing, separate consent for sensitive data and cross-border transfers, PI impact assessments, and data subject rights. Applies extraterritorially to processing of data of people in China to provide products/services or analyze their behavior. Cross-border transfers need a CAC security assessment, standard contract, or certification.

Who it applies to

Any personal information processor handling PI of natural persons in China, including offshore processors that target or analyze people in China (must appoint a local representative). CII operators and processors reaching CAC-set volumes must store PI in China (Art. 40).

Penalties

Ordinary violations: rectification, confiscation of illegal gains, fines up to RMB 1 million (individuals responsible RMB 10,000-100,000). Serious violations: fines up to RMB 50 million or 5% of prior-year turnover, suspension of business or license revocation; responsible individuals RMB 100,000-1 million (Art. 66).

Enforced by

Cyberspace Administration of China (CAC) and other departments with PI protection duties at county level and above

Official name

Personal Information Protection Law of the People's Republic of China

Citation

Order of the President of the PRC No. 91 (adopted by the 13th NPC Standing Committee, 30th session)

Topics

privacy, data-residency, biometrics, children