Regulations › Rest of world › China
PIPL
Personal Information Protection Law (China)
WhenIn effect since 1 November 2021
Who enforces itCyberspace Administration of China
Who it applies toOrganizations processing personal information in China, or of people in China for certain purposes.
Tell the regulatorImmediately take remedial measures and notify the regulator of a leak, alteration or loss
DPO requiredHandlers processing personal information above the volume set by the CAC must appoint a person…
RegistrationNo general controller registration
Transfers abroadTransfers need CAC security assessment, certification or the CAC standard contract, plus notic…
Request deadlineHandle requests promptly
Maximum fineUp to RMB 50 million or 5% of prior-year revenue
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
2
Applies outside China when providing products or services to people in China or analyzing their behavior; foreign handlers need a local representative.Arts. 3, 53 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text.
Lawful basis
2
Consent or six other bases (contract/HR, legal duty, emergencies, news, public data, other laws); no legitimate interests.Art. 13 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text.
Consent
3
Consent must be informed, voluntary and explicit; separate consent for sensitive data, transfers abroad and publication; written where laws require.Arts. 14, 29, 39 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text.
Sensitive data
2
Sensitive data needs a specific purpose, sufficient necessity, strict safeguards and separate consent.Arts. 28-29 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text. Other laws may require prior approval for some categories.
Children
2
Under 14 requires parent or guardian consent and special handling rules; such data is sensitive.Arts. 28, 31 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text.
People's rights
Rights
3
Know and decide, restrict or refuse, access and copy, portability, correction, deletion, explanation and refusal of solely automated decisions.Arts. 24, 44-48 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text.
Request deadline
0
Handle requests promptly; no fixed day count in the PIPL.Art. 50 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text. Implementing rules or standards may set specific periods; not reviewed.
Marketing
2
Automated-decision marketing must offer a non-personalized option or easy refusal; marketing otherwise needs consent.Arts. 13, 24 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text. Advertising Law Art. 43 requires consent for electronic ads (not fetched).
Governance
DPO required
1
Handlers processing personal information above the volume set by the CAC must appoint a personal information protection officer.Art. 52 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text.
DPO qualifications
0
No qualification or certification set in the PIPL.Art. 52 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text.
Registration
0
No general controller registration; foreign handlers report their China representative to regulators.Art. 53 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text. Transfer mechanisms involve CAC filing (see transfers).
DPIA
3
Prior impact assessment required for sensitive data, automated decisions, outsourcing, sharing, publication and all cross-border transfers.Art. 55 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text. Scored 3 because triggers cover routine activities such as outsourcing and transfers.
Records
2
Keep processing records and assessment reports for at least three years; regular compliance audits required.Arts. 54, 56 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text.
Retention
2
Retain for the shortest period necessary; delete when purpose is achieved, consent withdrawn or retention period expires.Arts. 19, 47 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text.
Breaches
Tell the regulator
3
Immediately take remedial measures and notify the regulator of a leak, alteration or loss.Art. 57 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text. CAC incident-reporting measures (2025) set hour-level deadlines for network incidents; not reviewed.
Tell people
2
Notify individuals, unless measures effectively avoid harm and the regulator does not require notice.Art. 57 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text.
Transfers
Transfers abroad
3
Transfers need CAC security assessment, certification or the CAC standard contract, plus notice and separate consent.Arts. 38-39 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text. 2024 CAC rules on promoting cross-border data flows created exemptions; not reviewed.
Localization
2
Critical information infrastructure operators and handlers above CAC volume thresholds must store data collected in China domestically.Art. 40 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text.
Enforcement
Maximum fine
3
Up to RMB 50 million or 5% of prior-year revenue; responsible individuals RMB 100,000 to 1 million.Art. 66 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text.
Criminal liability
3
Violations constituting crimes are prosecuted under criminal law, including imprisonment for infringing personal information.Art. 71 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text. Criminal Law Art. 253-1 (up to 7 years) not fetched.
Private action
3
Tort claims with presumed fault of the handler; prosecutors and designated organizations may bring public interest suits.Arts. 69-70 · secondary source · source ↗
DigiChina (Stanford) English translation of the official Chinese text.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws