Personal Information Protection Law (PIPL)

· About Personal Information Protection Law (PIPL)

Key Takeaways

  • The Personal Information Protection Law (PIPL) applies to personal information processing in China and, in specified cases, to foreign organizations that target people in China or analyze their behavior there.[11]
  • The law took effect on 1 November 2021, and its core enforcement authority is the Cyberspace Administration of China (CAC), with other state departments also empowered to enforce it.[11][10]
  • Controllers must have a lawful basis, give notice, minimize collection, protect data, honor data-subject rights, and conduct impact assessments for higher-risk processing such as sensitive data and outbound transfers.[11][10]
  • Serious violations can trigger fines of up to RMB 50 million or 5% of the previous year’s turnover, plus suspension, shutdown, license revocation, and personal fines for responsible individuals.[11][10]
  • In 2026, China introduced a simplified compliance regime for small-scale personal information handlers, effective 1 September 2026, but it does not remove the underlying PIPL obligations.[8][13]
  • 2026 draft and guidance activity focused on practical implementation, including legal-basis guidance and simplified measures, showing that PIPL compliance remains actively evolving rather than static.[1][4][7]

What It Is

The PIPL is China’s comprehensive personal information protection statute, covering the collection, storage, use, disclosure, transfer, and deletion of personal information processed in China, as well as certain extraterritorial processing that affects individuals in China.[11] The law is enforced primarily by the CAC and, depending on the subject matter, by other competent departments under the State Council and related authorities.[10][11]

The PIPL was adopted on 20 August 2021 and entered into force on 1 November 2021.[11] There are no public reports in the sources reviewed of a wholesale amendment to the PIPL itself in 2025–2026; instead, China has been issuing implementing rules, draft guidance, and simplified compliance measures that shape how the law is applied in practice.[1][4][8][12]

A key 2026 development was the CAC and Ministry of Public Security’s Provisions on Simplified Measures for Personal Information Protection by Small-Scale Personal Information Handlers, issued on 22 July 2026 and effective 1 September 2026.[8][13] Separately, TC260 released draft amendments to the national standard on personal information security specification on 17 June 2026, with consultation ending 16 August 2026, indicating continuing technical refinement rather than a rewrite of the statute.[1]

Who Must Comply

PIPL applies to personal information processors that process personal information within China, regardless of sector, unless another law provides a specific exception or a narrower regime.[11] It also applies extra-territorially to foreign organizations and individuals where the purpose is to provide products or services to people in China, analyze or assess their behavior, or otherwise process personal information of individuals in China under conditions set by the law.[11]

The law uses a tiered compliance model rather than a single threshold for all obligations. Higher-risk activities such as processing sensitive personal information, automated decision-making, public disclosure, cross-border transfer, and processing personal information of children require enhanced safeguards, notices, and in some cases separate consent or impact assessments.[11]

The 2026 simplified-measures regime is aimed at small-scale personal information handlers and introduces proportionate obligations, including simplified audit and impact-assessment expectations, plus selected cross-border-transfer arrangements.[8][13] The sources reviewed indicate a threshold of fewer than 100,000 individuals for eligibility under that simplified framework, but the regime is best treated as a compliance simplification, not a PIPL exemption.[3][8]

PIPL contains limited carve-outs for processing necessary for statutory functions, public health emergencies, and certain news-gathering or public-opinion-supervision activities, subject to legal limits and privacy safeguards.[11] Those exceptions do not eliminate general duties of necessity, transparency, and security.[11]

Core Requirements

  1. Lawful basis and notice — Before processing, organizations must have a lawful basis, provide clear notice, and specify the purpose, scope, retention period, and individual rights involved.[11]
  2. Purpose limitation and minimization — Collection must be limited to the minimum necessary for the stated purpose, and organizations may not process personal information beyond what is reasonably relevant.[11]
  3. Sensitive personal information controls — Sensitive data requires a specific purpose, sufficient necessity, a separate notice, and separate consent unless another legal basis applies.[11]
  4. Data-subject rights — Individuals have rights to access, copy, correct, delete, and withdraw consent, and processors must establish mechanisms to receive and handle these requests.[11]
  5. Impact assessments — Organizations must perform personal information protection impact assessments for high-risk processing, including sensitive data, automated decision-making, public disclosure, and cross-border transfers, and retain records of those assessments.[11]
  6. Cross-border transfer governance — Transfers out of China require compliance with China’s transfer mechanisms and related security/contractual/certification requirements as applicable, together with separate notice and often separate consent.[11]
  7. Security and retention controls — Processors must adopt technical and organizational security measures, define retention periods, and delete or anonymize data once the purpose is fulfilled or retention expires.[11]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | PIPL adopted | 20 August 2021 | The National People’s Congress Standing Committee adopted the law.[11] | | PIPL in force | 1 November 2021 | The full statute became effective nationwide.[11] | | Simplified measures issued | 22 July 2026 | CAC/MPS issued simplified PIPL measures for small-scale handlers.[8][13] | | Simplified measures effective | 1 September 2026 | Simplified compliance rules apply to eligible small-scale handlers.[8][13] |

Maximum sanctions under Article 66 include an order to correct, confiscation of illegal gains, suspension or termination of services, and for serious cases a fine of up to RMB 50 million or 5% of the previous year’s turnover.[11][10] For serious cases, authorities may also order suspension of relevant business, shutdown for rectification, revoke permits or licenses, and impose director/officer bans for a period of time.[11][10]

For less serious violations, the law authorizes a fine of up to RMB 1 million on the processor and RMB 100,000 on directly responsible persons; the law also contemplates fines and corrective orders even for initial non-compliance.[10][11] The 2025–2026 simplified-measures materials do not replace these penalties; they only adjust how small-scale handlers may meet compliance obligations.[8][13]

How to Comply

  1. Map processing activities — Build a data inventory covering purposes, categories, sources, recipients, retention, and cross-border flows, aligned to PIPL notice and minimization duties and to ISO 27001 asset and information classification controls.
  2. Classify data and legal bases — Separate ordinary personal information from sensitive personal information, then document the lawful basis and consent logic for each use case; this maps well to ISO 42001 governance and risk controls for AI-enabled processing.
  3. Close notice and consent gaps — Redraft privacy notices, separate consents, and child-data notices so they are specific, understandable, and tied to each processing purpose.
  4. Run impact assessments — Create a repeatable PIA process for sensitive data, automated decision-making, public disclosure, and cross-border transfer; use NIST CSF 2.0’s Govern and Identify functions to structure accountability and risk review.
  5. Implement security controls — Use ISO 27001-style access control, encryption, logging, vendor management, and incident response to satisfy PIPL’s security expectations and evidence defensible operation.
  6. Build rights-response workflows — Establish intake, identity verification, SLA tracking, deletion logic, and appeal handling for access, correction, deletion, and consent-withdrawal requests.
  7. Control cross-border transfers — Determine whether a security assessment, standard contract, certification, or another approved mechanism applies, then document onward-transfer restrictions and recipient obligations.
  8. Prepare for audits and inspections — Keep assessment records, consent logs, vendor contracts, and transfer files ready for regulator review; eligible small-scale handlers should also track the 2026 simplified framework.

Related Regulations

The Data Security Law (DSL) overlaps with PIPL on governance, security categorization, and regulator powers, but it is broader because it regulates data generally rather than only personal information. The Cybersecurity Law (CSL) overlaps on network-security duties, incident response, and critical infrastructure obligations, and the 2025 amendments were described as aligning penalties more closely with the DSL and PIPL.[6] The Administrative Provisions on the Security of Cross-border Transfers of Personal Information sit beside PIPL by operationalizing international transfer rules, so organizations must follow both the statute and the transfer mechanism. The Children’s personal information rules are stricter than the baseline PIPL rules and add special consent and reporting expectations for processing under-14 data.[15] The ISO 27001 and ISO 42001 standards are not laws, but they are practical control frameworks that map well to PIPL governance, security, and AI decision-making controls.

Does PIPL apply to companies outside China?

Yes. Foreign organizations can fall within PIPL if they target goods or services to individuals in China or analyze their behavior in China.[11] That means an offshore SaaS provider, adtech company, or platform can be in scope even without a legal entity in mainland China.[11]

Does the 2026 simplified regime exempt small companies from PIPL?

No. The 2026 simplified measures reduce or tailor certain compliance steps for eligible small-scale handlers, but they do not repeal PIPL obligations.[8][13] Small processors still need lawful bases, security controls, and rights-handling processes, just in a proportionate form.[8][13]

What is the biggest PIPL fine?

For serious violations, the maximum administrative fine is RMB 50 million or 5% of the previous year’s turnover, whichever is higher under the statute’s ceiling framework.[11][10] Authorities can also suspend business, revoke licenses, and prohibit responsible individuals from holding certain roles for a period.[11][10]

Do we need separate consent for sensitive personal information?

Usually yes. PIPL requires a specific purpose, necessity, and separate notice, and in most cases separate consent for sensitive personal information processing.[11] The practical effect is that ordinary privacy consent is often not enough for health data, financial account details, precise location, biometrics, or similar high-risk data.[11]

What changed in 2025–2026?

The most visible 2025–2026 developments were not a full PIPL amendment but implementing and interpretive activity: simplified measures for small-scale handlers in July 2026, draft TC260 amendments to the personal information security specification in June 2026, and continuing sector guidance on audits and legal-basis use cases.[1][4][7][8] Those developments signal a more operational, risk-based compliance model rather than a major rewrite of the statute.[1][8]

Sources

Put it into practice

More compliance guides