China PIPL Compliance

Overview

The Personal Information Protection Law of the People's Republic of China (PIPL, 个人信息保护法) was adopted by the Standing Committee of the National People's Congress on 20 August 2021 and took effect on 1 November 2021. The PIPL is China's first comprehensive national personal information protection law, operating alongside the Cybersecurity Law (CSL, effective 1 June 2017) and the Data Security Law (DSL, effective 1 September 2021) to form China's data governance framework.

The Cyberspace Administration of China (CAC, 国家互联网信息办公室) is the primary regulator, with enforcement authority shared among the Ministry of Public Security, the Ministry of Industry and Information Technology (MIIT), and sector-specific regulators.

Scope and Extraterritorial Application

Territorial Scope (Art. 3)

The PIPL applies to:

1. Processing of personal information of natural persons within the territory of the PRC (Art. 3(1))
2. Processing conducted outside the PRC of personal information of natural persons within the PRC where the purpose is:
   • Providing products or services to natural persons within the PRC (Art. 3(2)(i))
   • Analysing or assessing the behaviour of natural persons within the PRC (Art. 3(2)(ii))
   • Other circumstances provided by laws or administrative regulations (Art. 3(2)(iii))