Regulations › Rest of world › China
PIPL
Personal Information Protection Law (China)
WhenIn effect since 1 November 2021
Who enforces itCyberspace Administration of China
Who it applies toOrganizations processing personal information in China, or of people in China for certain purposes.
Tell the regulatorImmediately take remedial measures and notify the regulator of a leak, alteration or loss
DPO requiredHandlers processing personal information above the volume set by the CAC must appoint a person…
RegistrationNo general controller registration
Transfers abroadTransfers need CAC security assessment, certification or the CAC standard contract, plus notic…
Request deadlineHandle requests promptly
Maximum fineUp to RMB 50 million or 5% of prior-year revenue
62%
of China's 21 requirements are already met by European Union (GDPR). Here is what PIPL adds, biggest gaps first.
LocalizationTransfersBig gap
GDPR– Not addressed
PIPL adds2 Critical information infrastructure operators and handlers above CAC volume thresholds must store data collected in China domestically.
Art. 40 · source ↗
Criminal liabilityEnforcementBig gap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
PIPL adds3 Violations constituting crimes are prosecuted under criminal law, including imprisonment for infringing personal information.
Art. 71 · source ↗
Lawful basisReach and lawful basisGap
GDPR1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
PIPL adds2 Consent or six other bases (contract/HR, legal duty, emergencies, news, public data, other laws); no legitimate interests.
Art. 13 · source ↗
ConsentReach and lawful basisGap
GDPR2 Consent must be freely given, specific, informed and unambiguous by clear affirmative action, and the controller must be able to demonstrate it.
PIPL adds3 Consent must be informed, voluntary and explicit; separate consent for sensitive data, transfers abroad and publication; written where laws require.
Arts. 14, 29, 39 · source ↗
DPIAGovernanceGap
GDPR2 DPIA required before processing likely to result in high risk; prior consultation if residual high risk remains.
PIPL adds3 Prior impact assessment required for sensitive data, automated decisions, outsourcing, sharing, publication and all cross-border transfers.
Art. 55 · source ↗
RetentionGovernanceGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
PIPL adds2 Retain for the shortest period necessary; delete when purpose is achieved, consent withdrawn or retention period expires.
Arts. 19, 47 · source ↗
Tell the regulatorBreachesGap
GDPR2 Notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless risk is unlikely.
PIPL adds3 Immediately take remedial measures and notify the regulator of a leak, alteration or loss.
Art. 57 · source ↗
Transfers abroadTransfersGap
GDPR2 Transfers outside the EEA need an adequacy decision or appropriate safeguards (SCCs, BCRs), or a listed derogation.
PIPL adds3 Transfers need CAC security assessment, certification or the CAC standard contract, plus notice and separate consent.
Arts. 38-39 · source ↗
Already covered by GDPR: Reach abroad, Sensitive data, Children, Rights, Request deadline, Marketing, DPO required, DPO qualifications, Registration, Records, Tell people, Maximum fine, Private action.
A gap means PIPL is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws