China Personal Information Protection Law (PIPL)
China's comprehensive personal information protection statute (effective 1 November 2021), administered by the Cyberspace Administration of China. Establishes legal bases for handling personal information, sensitive-PI and minors' rules, cross-border transfer mechanisms, individual rights, handler obligations (PIPIA, DPO, breach notification, audits) and legal liability.
China Personal Information Protection Law (PIPL) is a compliance framework from People's Republic of China (with extraterritorial reach under Article 3(2)) with 7 domains and 36 controls that map to 7 other frameworks. The largest domains are Chapter II Section 1: General processing rules (Articles 13 to 27) – China Personal Information Protection Law (PIPL) (10 controls), Chapter V: Obligations of personal information processors (Articles 51 to 59) – China Personal Information Protection Law (PIPL) (8 controls), Chapter I: General provisions and principles (Articles 5 to 10) – China Personal Information Protection Law (PIPL) (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (7)
Chapter I: General provisions and principles (Articles 5 to 10) – China Personal Information Protection Law (PIPL)
| Code | Title |
|---|---|
| china-personal-information-protection-law-pipl::5 | Art. 5 Lawful, necessary, justified and good-faith processing; no misleading, fraud or coercion |
| china-personal-information-protection-law-pipl::6 | Art. 6 Explicit, reasonable and directly related purposes with minimum impact; collection limited to the minimum scope |
| china-personal-information-protection-law-pipl::7 | Art. 7 Openness and transparency: processing rules disclosed, purposes, means and scope explicit |
| china-personal-information-protection-law-pipl::8 | Art. 8 Quality: accuracy and completeness guaranteed to avoid adverse impact |
| china-personal-information-protection-law-pipl::9-10 | Art. 9-10 Responsibility for processing and security; prohibited conduct |
Chapter II Section 1: General processing rules (Articles 13 to 27) – China Personal Information Protection Law (PIPL)
| Code | Title |
|---|---|
| china-personal-information-protection-law-pipl::13 | Art. 13 Process only on one of the seven lawful circumstances |
| china-personal-information-protection-law-pipl::14-16 | Art. 14-16 Consent voluntary, explicit and fully informed; new consent on change; withdrawal made convenient; no refusal of service for withholding consent |
| china-personal-information-protection-law-pipl::17-18 | Art. 17-18 Pre-processing notice: processor identity, purposes, means, categories, retention, rights procedures; changes notified; public processing rules; the exceptions |
| china-personal-information-protection-law-pipl::19 | Art. 19 Retention limited to the minimum period necessary |
| china-personal-information-protection-law-pipl::20 | Art. 20 Joint processors agree their rights and obligations and bear joint and several liability |
| china-personal-information-protection-law-pipl::21 | Art. 21 Entrusted processing: written agreement, supervision, no processing beyond the agreement, return or deletion, no sub-entrustment without consent |
| china-personal-information-protection-law-pipl::22 | Art. 22 Transfers on merger, division, dissolution or bankruptcy: inform individuals, recipient bound, new purpose needs consent |
| china-personal-information-protection-law-pipl::23 | Art. 23 Provision to another processor: inform of the recipient, purposes, means and categories and obtain separate consent; recipient bound to that scope |
| china-personal-information-protection-law-pipl::24 | Art. 24 Automated decision-making: transparency, fairness, no unreasonable price discrimination, opt-out from targeted push, explanation and refusal of solely automated significant decisions |
| china-personal-information-protection-law-pipl::25-27 | Art. 25-27 No disclosure without separate consent; public-place image and identification equipment; limits on using publicly available information |
Chapter II Sections 2 and 3: Sensitive personal information, minors and state organs (Articles 28 to 36) – China Personal Information Protection Law (PIPL)
| Code | Title |
|---|---|
| china-personal-information-protection-law-pipl::28-29 | Art. 28-29 Sensitive personal information only for a specific purpose with sufficient necessity and strict protection, on separate (or written) consent |
| china-personal-information-protection-law-pipl::30 | Art. 30 Sensitive processing notice: the necessity and the impact on rights and interests |
| china-personal-information-protection-law-pipl::31-32 | Art. 31-32 Minors under fourteen: guardian consent and special processing rules; administrative permits where required |
| china-personal-information-protection-law-pipl::34-36 | Art. 34-36 State organs: within statutory authority and scope, with notice, storing within China and security assessment before any provision abroad |
Chapter III: Cross-border provision (Articles 38 to 41) – China Personal Information Protection Law (PIPL)
| Code | Title |
|---|---|
| china-personal-information-protection-law-pipl::38 | Art. 38 Cross-border provision only through one of the four mechanisms, with the overseas recipient held to the Law's standard |
| china-personal-information-protection-law-pipl::39 | Art. 39 Cross-border notice and separate consent |
| china-personal-information-protection-law-pipl::40 | Art. 40 Domestic storage for critical information infrastructure operators and processors above the CAC threshold; security assessment before provision abroad |
| china-personal-information-protection-law-pipl::41 | Art. 41 No provision of data stored in China to foreign judicial or law enforcement authorities without competent-authority approval |
Chapter IV: Individuals' rights and the processor's duties to honour them (Articles 44 to 50) – China Personal Information Protection Law (PIPL)
| Code | Title |
|---|---|
| china-personal-information-protection-law-pipl::44-45 | Art. 44-45 Right to know, decide, restrict and refuse; access, copy and portability provided in a timely manner |
| china-personal-information-protection-law-pipl::46 | Art. 46 Rectification and supplementation after verification |
| china-personal-information-protection-law-pipl::47 | Art. 47 Proactive deletion on five triggers, and deletion on request; where deletion is barred, stop all processing but storage and protection |
| china-personal-information-protection-law-pipl::48-50 | Art. 48-50 Explain the processing rules on request, honour close relatives' rights over the deceased, run a request mechanism and give reasons for refusals |
Chapter V: Obligations of personal information processors (Articles 51 to 59) – China Personal Information Protection Law (PIPL)
| Code | Title |
|---|---|
| china-personal-information-protection-law-pipl::51 | Art. 51 Security and compliance measures: internal systems, classified management, encryption and de-identification, access authority and training, incident plans |
| china-personal-information-protection-law-pipl::52 | Art. 52 Person in charge of personal information protection above the CAC threshold, contact details published and reported |
| china-personal-information-protection-law-pipl::53 | Art. 53 Overseas processors within Article 3(2) establish a specialised agency or representative in China and report it |
| china-personal-information-protection-law-pipl::54 | Art. 54 Regular compliance audits |
| china-personal-information-protection-law-pipl::55-56 | Art. 55-56 Personal information protection impact assessment before sensitive, automated, shared, published or cross-border processing, with records kept three years |
| china-personal-information-protection-law-pipl::57 | Art. 57 Breach: immediate remediation and notification to the departments and the individuals with the prescribed content |
| china-personal-information-protection-law-pipl::58 | Art. 58 Large internet platforms: compliance system with an independent external supervisory body, platform rules, expulsion of violators, public responsibility reports |
| china-personal-information-protection-law-pipl::59 | Art. 59 Entrusted parties secure the information and assist the processor |
Chapter VI: Cooperation with the departments with protection duties (Articles 63 and 64) – China Personal Information Protection Law (PIPL)
| Code | Title |
|---|---|
| china-personal-information-protection-law-pipl::63-64 | Art. 63-64 Cooperate with inspections, act on interviews and ordered audits, and rectify risks |
Your Compliance Coverage
If you comply with China Personal Information Protection Law (PIPL), you already cover:
GDPR
43%
38 controls mapped
Compare →CCPA/CPRA
8%
7 controls mapped
Compare →China Cybersecurity Law (CSL)
5%
4 controls mapped
Compare →+ 4 more: NIST Cybersecurity Framework 2.0 (5%), China Data Security Law (DSL) (5%)
See all 7 mapped frameworks ↓Maps to 7 other frameworks
Coverage is not the same as your position
This page shows what China Personal Information Protection Law (PIPL) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is China Personal Information Protection Law (PIPL) and who does it apply to?
China Personal Information Protection Law (PIPL) is a compliance framework from People's Republic of China (with extraterritorial reach under Article 3(2)) with 7 domains and 36 controls. China's comprehensive personal information protection statute (effective 1 November 2021), administered by the Cyberspace Administration of China. Establishes legal bases for handling personal information, sensitive-PI and minors' rules, cross-border transfer mechanisms, individual rights, handler obligations (PIPIA, DPO, breach notification, audits) and legal liability. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does China Personal Information Protection Law (PIPL) actually require?
China Personal Information Protection Law (PIPL) has 36 controls organised across 7 domains. The largest domains are Chapter II Section 1: General processing rules (Articles 13 to 27) – China Personal Information Protection Law (PIPL) (10 controls), Chapter V: Obligations of personal information processors (Articles 51 to 59) – China Personal Information Protection Law (PIPL) (8 controls), Chapter I: General provisions and principles (Articles 5 to 10) – China Personal Information Protection Law (PIPL) (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of China Personal Information Protection Law (PIPL) do I already cover?
China Personal Information Protection Law (PIPL) maps to 7 other compliance frameworks. The top mapping partners are GDPR (43% coverage), CCPA/CPRA (8% coverage), China Cybersecurity Law (CSL) (5% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement China Personal Information Protection Law (PIPL)?
Start your China Personal Information Protection Law (PIPL) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about China Personal Information Protection Law (PIPL) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 36 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required