What Is Personal Information Protection Law of the People's Republic of China?

Yes, when the Article 3 conditions apply. PIPL can cover processing outside China for offering products or services to people in China or analyzing or evaluating their behavior. A covered foreign handler must designate a China-based representative or institution and report the relevant information to the competent authority as required by the law; the exact compliance route depends on the activity and current rules.

Article 38 lists a CAC security assessment, personal-information protection certification under CAC rules, a standard contract under CAC rules, or another applicable law, regulation, or CAC condition. The March 2024 cross-border regulations add important-data and volume thresholds, exemptions, and free-trade-zone negative-list rules: for example, non-CIIO processors generally face security-assessment thresholds at important data, 1 million or more non-sensitive individuals, or 10,000 or more sensitive individuals, while a lower band can use the standard-contract or certification route. Certain contract, employment, emergency, low-volume, and other listed cases can be exempt from those mechanisms, but notice, separate-consent, impact-assessment, and security duties may still apply.

CIIOs are operators of critical information infrastructure identified under China's cybersecurity framework. PIPL requires CIIOs to store personal information collected and generated in China domestically; where it is truly necessary to provide that information overseas, Article 40 generally requires a CAC-organized security assessment, subject to later laws, regulations, or CAC provisions that make an assessment unnecessary. Do not treat the sector examples or the transfer outcome as automatic without checking the current designation and rules.

Article 65 allows any organization or individual to complain or report illegal personal-information processing to a department with personal-information protection duties, which must handle the matter under law and publish contact information. Use the current CAC or relevant local/sectoral department route for the processing at issue. A rights request rejected by a processor can support a people's-court action under applicable law, while Article 69 damages and Article 70 public-interest litigation have their own statutory conditions.