China. Comprehensive data protection. Law

PIPLPersonal Information Protection Law of the People's Republic of China (个人信息保护法)

In force

§1Summary

Synopsis

China's general personal information law, setting legal bases, notice and separate-consent rules, individual rights and duties for 'personal information handlers'. It also governs outbound transfers and gives the CAC a coordinating enforcement role alongside sector regulators.

Key themes

legal bases
separate consent
sensitive PI
individual rights
PI protection officer
PIPIA
cross-border transfers
local representative
compliance audits

Unique features

Consent-centred with 'separate consent' for sensitive data, sharing and export; no legitimate-interests basis. Offshore handlers caught must appoint a representative in China, and large platforms carry gatekeeper-style duties.

SaaS relevance

Applies to foreign SaaS providers offering products or services to individuals in China or analysing their behaviour, and any export of China-collected PI needs one of the CAC transfer routes.

§2Obligations

Extraterritorial: Yes
Breach notification: Notify regulator and individuals promptly (individual notice may be skipped if harm effectively mitigated); CAC incident-reporting measures add hour-based deadlines from 2025-11-01
DPO: Conditional
Cross-border transfers: CAC security assessment / standard contract filing / certification, subject to 2024 thresholds and exemptions
Maximum penalty: RMB 50m or 5% of prior-year revenue, plus business suspension and personal fines for responsible managers

§3Dates

Key dates

Adopted 20 August 2021
In force 1 November 2021
Adopted by NPC Standing Committee 2021-08-20; implementing rules since include NDSMR (2025-01-01), compliance audit measures (2025-05-01), certification measures (2026-01-01)

§4Text and authority

Text

Authoritative text npc.gov.cn
English text digichina.stanford.edu

Authority

Cyberspace Administration of China (CAC)

§5Where it applies

Domestic law of: China

§6Sources and verification

Sources consulted

Verification

High confidence.

DPO threshold (1m individuals) set by NDSMR/audit measures; DLA notes an inconsistency between 1m and 10m in its summary. Revenue base for 5% fine (China vs global) is unsettled.