China PIPL (Personal Information Protection Law)

China's Personal Information Protection Law (个人信息保护法, PIPL) is the personal-data layer of the China compliance stack. ISMS Copilot helps you interpret it, draft the documents it requires, and run the cross-border analysis, in Chinese or English.

What the law covers

• Scope: processing inside China, plus offshore processing of the personal information of people in China when it offers them products or services or analyses their behaviour (Article 3). This extraterritorial reach is why foreign SaaS and AI providers fall in scope without a China entity.
• Lawful bases: consent is the headline basis, but Article 13 lists the others (contract necessity, HR management under lawful labor rules, statutory duties, and more). Separate consent applies to sensitive data and cross-border provision.
• Sensitive personal information: biometrics, religious beliefs, specific identity, medical health, financial accounts, location, and any personal information of minors under 14 (Articles 28-32).
• Automated decision-making: transparency, an explanation right, a refusal route for decisions made only by automated means, and a ban on unreasonable price discrimination (Article 24).
• Individual rights: access, copy, portability, correction, deletion, with rules for deceased persons' close relatives (Articles 44-50).
• Processor duties: security measures, a designated person in charge above the CAC volume threshold, periodic compliance audits, impact assessments with 3-year records (Articles 51-59), and the offshore-representative duty: processors outside China establish a PRC office or designate a representative (Article 53).
• Penalties: up to CNY 1,000,000 for refusing to correct; serious violations up to CNY 50,000,000 or 5% of prior-year turnover, with business suspension and licence revocation; personal fines up to CNY 1,000,000 (Article 66).

Cross-border transfers (Articles 38-43)

Article 38 sets the conditions for providing personal information outside China: a CAC-organised security assessment, personal information protection certification, the CAC standard contract, or other conditions set by law or CAC rules, plus an international-treaty route. The 2024 Provisions on Promoting and Regulating Cross-border Data Flows (CAC Order No. 16, in force 22 March 2024) set the operative volumes and exemptions: security assessment for critical information infrastructure operators, for non-CIIO processors providing important data abroad, and for transfers covering 1,000,000 or more individuals' non-sensitive data or 10,000 or more individuals' sensitive data in a year; the standard contract or certification for 100,000 to under 1,000,000 non-sensitive or under 10,000 sensitive; exemptions below 100,000 non-sensitive (non-CIIO only), for contract necessity, HR data, and emergencies (checked October 2026).

How to invoke PIPL context

Name the law explicitly so the assistant reads the China stack rather than defaulting to GDPR habits.

Instead of: "Write a privacy notice"

Use: "Write a PIPL Article 17 collection notice for our Shanghai entity's HR data"

For cross-border analysis: "We transfer HR data for 300,000 employees in China to our group HR platform in Germany: which route applies?" State the data categories, the yearly volumes, and whether critical information infrastructure is involved; the assistant works through the Article 38 conditions and the 2024 Provisions thresholds.

How PIPL sits with the rest of the China stack

The Cybersecurity Law (revised consolidated text in force 1 January 2026) carries the network-operator and MLPS duties; the Data Security Law carries the data-management and important-data regime; PIPL is the personal-data layer. Most China programmes run all three plus the cross-border routes. See Using ISMS Copilot from China and the China region page.