What Is PIPL? Personal Information Protection Law of the People's Republic of China
The Personal Information Protection Law of the People's Republic of China (PIPL, 个人信息保护法) is China's first comprehensive personal-information protection statute. Passed by the Standing Committee of the National People's Congress on 20 August 2021 and in force 1 November 2021, PIPL operates alongside the Cybersecurity Law and Data Security Law in China's data-protection framework. PIPL has GDPR-like rights but also China-specific rules on lawful processing, sensitive personal information, automated decision-making, domestic storage, cross-border transfers, and regulator oversight. The CAC coordinates personal-information protection, while relevant State Council and local-government departments handle supervision within their assigned duties. Articles 38–43 set the statutory cross-border framework. The March 22, 2024 Regulations on Promoting and Regulating Cross-Border Data Flows added exemptions, annual-volume thresholds, and free-trade-zone negative-list options; the 2023 standard-contract measures and certification rules still matter. These rules do not turn every transfer into the same approval process. The Small Personal Information Processors Simplified Measures were published on July 24, 2026 and took effect on September 1, 2026; they simplify specified compliance steps for processors handling fewer than 100,000 individuals but do not replace the PIPL.
At a glance
- Full name
- Personal Information Protection Law of the People's Republic of China
- Short code
- PIPL
- Jurisdiction
- China
- Enacted
- 2021
- Last major update
- In force November 1, 2021; Regulations on Promoting and Regulating Cross-Border Data Flows effective March 22, 2024; Personal Information Protection Compliance Audit Measures effective May 1, 2025; Small Personal Information Processors Simplified Measures took effect on September 1, 2026
- Regulator
- Cyberspace Administration of China (CAC) + sectoral regulators
- Private right of action
- Limited
- Statutory citation
- Personal Information Protection Law of the People's Republic of China
International privacy-law explainer timeline
Enacted years are counted by decade from the published explainer dataset; the table lists the laws in each decade.
- Decade containing a highlighted explainer
- Other decades
195
Planning jurisdictions
167
Published law explainers
92
Partial official reviews
The ledger coverage split is 195 planning jurisdictions, 167 published law explainers, and 92 partial official reviews. 4 of 167 explainers lack an enacted year, so they are omitted from the decade counts.
Show the data as a table
| Decade | Explainers with an enacted year | Laws (short codes) |
|---|---|---|
| 1970s | 1 | Loi Informatique et Libertés |
| 1980s | 2 | Privacy Act 1988, Privacy Law 5741-1981 |
| 1990s | 2 | DSG, Constitution Article 28 |
| 2000s | 15 | PIPEDA, APPI, Law 25.326, Law on Personal Data Protection, Law 09-08, 152-FZ, Law No. 2008-12, Organic Law No. 2004-63, PDPA, DPA 2003, Art. 21(2), 25, 130–131 + Law 254, Lei n.º 133/V/2001, Uruguay Ley 18.331, Iran Electronic Commerce Act 2003, Saint Vincent and the Grenadines Privacy Act No. 18 of 2003 |
| 2010s | 81 | UK GDPR, LGPD, BDSG, RA 10173, POPIA, Malaysia PDPA, Korea PIPA, UAVG, PECA + Art. 14, Law 29733, Thai PDPA, KVKK, Poland GDPR + UODO Act, Portugal GDPR + Lei 58/2019, Romania GDPR + Law 190/2018, Law 1581, Law No. 94-V, HO-49-N, Law 998-IIIQ, Info tv. + GDPR, Act No. 90/2018 + GDPR, Data Protection Act 2019, PDL, Law of 1 August 2018, Chapter 586, IKS, Act 843, Law 4624/2019, Law 87/2018, Act No. 18/2018 Coll., Law No. 2297-VI, Act on the Implementation of the GDPR, Law 125(I)/2018, Act No. 110/2019 Coll., Belgian Data Protection Act, Databeskyttelsesloven, Data Protection Act 1050/2018, Personal Data Act, Sectoral Privacy Protections, Law No. 18-07 + Law No. 25-11, Law No. 22/11, Data Protection Act 2013, Law No. 30 of 2018, Data Protection Act 2019-29, Code du numérique, Book V, ICM Act 2018 + NDGF 2025, Fragmented privacy framework, Ley 8968, Ley 172-13, GDPR + Data Protection Act, Mali Law 2013-015, Mauritania Law 2017-020, Mauritius DPA 2017, Nepal Privacy Act 2075, Panama Ley 81/2019, Qatar Law No. 13 of 2016, Saint Lucia DPA 2011, Togo Law 2019-014, Turkmenistan Law 519-V, Chad Law 007/PR/2015, Congo Law 29-2019, Côte d'Ivoire Law 2013-450, Equatorial Guinea Law 1/2016, Fiji Privacy Framework, Guinea Law L/2016/037/AN, Haiti 2018 Data Privacy Order, Lao Law 25/NA, Lebanon Law 81/2018, Lesotho Data Protection Act 2011, Madagascar Law 2014-038, Myanmar Privacy and Security Law, Nicaragua Law No. 787, Saint Kitts and Nevis DPA No. 5 of 2018, San Marino Law No. 171/2018, Lei n.º 03/2016, Law No. 1537, Trinidad and Tobago DPA 2011, Uganda DPA 2019, U.S. Privacy Law, Law No. O‘RQ-547, Law No. 13 of 2012 |
| 2020s | 62 | DPDP Act, PIPL (highlighted), UAE PDPL, NDPA, PDPL, Law No. 91/2025, Act No. 63 of 2026, Law 21.719, Law No. 151 of 2020, UU PDP, LFPDPPP (2025), Law 124/2024, Law 12/25, Data Protection Act 2020, Digital Code, Law no. 195/2024, Law on Personal Data Protection, Law No. 3144, Law 42/2020, ZVOP-2, PDPA, LQPD, Law No. 99-Z, Data Protection Act 2021, Data Protection Act 2024, PDPO 2025, Loi n°001-2021/AN, Law No. 1/03 of 2026, Law No. 2024/017, Law No. 24.001, LOPDP, LPDP, Malawi DPA 2024, Monaco Law 1.565, Oman PDPL, Paraguay Law 7593/2025, Rwanda Law 058/2021, Tanzania PDPA 2022, Vanuatu DPPA 2024, Zimbabwe Cyber and Data Protection Act, Cuba Law 149/2022, DPRK Information Law materials, DRC Digital Code 2023, Djibouti Digital Code 2025, Eswatini Data Protection Act 2022, Ethiopia Proclamation No. 1321/2024, Gabon Law 025/2023, Grenada Data Protection Act 2023, Guyana Data Protection Act 2023, Jordan Personal Data Protection Law No. 24 of 2023, Kiribati Data Protection Act 2025, Kuwait CITRA Decision 2024/26, Libya Law No. 6 of 2022, Liechtenstein DSG 2026, Marshall Islands PDPA 2025, Niger Law No. 2022-59, Seychelles Data Protection Act 2023, Somalia Data Protection Act 2023, Law No. 12 of 2024, Privacy Act 2025, Zambia Data Protection Act 2021, Decree DCLVII |
Sources: PIPL statutory citation · OfflistMe jurisdiction research ledger · Checked international explainers 2026-10-12; coverage ledger 2026-10-12
Scope, who PIPL covers
Continue with related privacy resources
Follow the route that matches your next question. Each link stays within a documented topic cluster and points to a canonical content page.
Protected data
Data subject rights
Right to know the processing rules and make decisions about processing (Article 44)
Right to restrict or refuse processing by others (Article 44)
Right of access and copy of personal information (Article 45)
Right to correction and supplementation (Article 46)
Right to request deletion when an Article 47 circumstance or other applicable legal condition exists
Right to request transfer of personal information to a designated processor where Article 45 and applicable CAC conditions are met
Right to an explanation of the processing rules
Right to request an explanation of a significant automated decision and refuse a decision made only through automated decision-making (Article 24)
Right to use the processor's rights-request mechanism, complain or report illegal processing to a department with personal-information protection duties, and bring a lawsuit where the law permits
Notable features
PIPL's distinctive features include: (1) cross-border data-transfer mechanisms that can involve a CAC security assessment, a standard contract under CAC rules, certification, or another applicable legal/regulatory route; (2) domestic-storage and security-assessment rules for CIIOs and prescribed-volume processors; (3) burden allocation in civil damages claims under Article 69; and (4) coordination with the Cybersecurity Law and Data Security Law. The 2024 cross-border regulations and the small-processor measures that took effect on September 1, 2026 must be checked for the transfer or processor at issue.
Enforcement & penalties
Regulator: Cyberspace Administration of China (CAC) + sectoral regulators
Penalties: Article 66 distinguishes ordinary violations from serious violations. Ordinary measures can include correction orders, warnings, confiscation of illegal gains, app-service suspension or termination, and—when the violator refuses to correct—a fine of up to RMB 1 million plus fines for directly responsible people. Serious violations can carry a fine of up to RMB 50 million or 5% of the previous year's turnover, possible business suspension or license action, fines of RMB 100,000–1 million for directly responsible people, and possible management bans. Public-security or criminal liability can also apply under Article 71; outcomes depend on the conduct and authority involved.
Private right of action: Articles 50 and 69 support civil litigation in defined circumstances: a person whose rights request is rejected may sue under the law, and a processor that infringes personal-information rights and cannot prove it was not at fault can bear damages and other tort liability. Article 70 provides a public-interest litigation route for the people's procuratorate, qualifying consumer organizations, and an organization designated by the CAC when many individuals' rights are infringed; this is not a blanket individual class-action right.
Relevance to data brokers
PIPL's Article 3 can reach an overseas provider that offers products or services to people in China or analyzes their behavior. A data broker's exposure depends on the processing role, purpose, source, legal basis, location, outbound transfer, and applicable exceptions; the provider's location alone is not enough. As a dated enforcement example, the CAC stated that its July 2022 RMB 8.026 billion Didi penalty was based on violations of the Cybersecurity Law, Data Security Law, PIPL, and Administrative Penalty Law. That case does not establish a penalty or outcome for every foreign broker.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Does PIPL apply to foreign companies?+
Yes, when the Article 3 conditions apply. PIPL can cover processing outside China for offering products or services to people in China or analyzing or evaluating their behavior. A covered foreign handler must designate a China-based representative or institution and report the relevant information to the competent authority as required by the law; the exact compliance route depends on the activity and current rules.
What are PIPL cross-border transfer requirements?+
Article 38 lists a CAC security assessment, personal-information protection certification under CAC rules, a standard contract under CAC rules, or another applicable law, regulation, or CAC condition. The March 2024 cross-border regulations add important-data and volume thresholds, exemptions, and free-trade-zone negative-list rules: for example, non-CIIO processors generally face security-assessment thresholds at important data, 1 million or more non-sensitive individuals, or 10,000 or more sensitive individuals, while a lower band can use the standard-contract or certification route. Certain contract, employment, emergency, low-volume, and other listed cases can be exempt from those mechanisms, but notice, separate-consent, impact-assessment, and security duties may still apply.
What is a 'Critical Information Infrastructure Operator' (CIIO)?+
CIIOs are operators of critical information infrastructure identified under China's cybersecurity framework. PIPL requires CIIOs to store personal information collected and generated in China domestically; where it is truly necessary to provide that information overseas, Article 40 generally requires a CAC-organized security assessment, subject to later laws, regulations, or CAC provisions that make an assessment unnecessary. Do not treat the sector examples or the transfer outcome as automatic without checking the current designation and rules.
How do I file a PIPL complaint?+
Article 65 allows any organization or individual to complain or report illegal personal-information processing to a department with personal-information protection duties, which must handle the matter under law and publish contact information. Use the current CAC or relevant local/sectoral department route for the processing at issue. A rights request rejected by a processor can support a people's-court action under applicable law, while Article 69 damages and Article 70 public-interest litigation have their own statutory conditions.
Official sources & citations
- Supreme People's Procuratorate: official English PIPL text
- CAC: official Chinese PIPL text
- CAC: Regulations on Promoting and Regulating Cross-Border Data Flows
- CAC: Measures for Standard Contract for Cross-Border Transfer
- CAC: Personal Information Protection Compliance Audit Measures
- CAC: Small Personal Information Processors Simplified Measures
Other international privacy regimes
PIPL sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: