China PIPL Copilot

The Personal Information Protection Law (个人信息保护法) is China's general data protection law, adopted 20 August 2021 and in force 1 November 2021. It is supervised by the Cyberspace Administration of China (CAC) and sector regulators, and it reaches services offered from outside China when they target people in China or analyse their behaviour (Article 3). Source: official text via CAC, https://www.cac.gov.cn/2021-08/20/c_1631050028355286.htm (checked 22 October 2026).

China PIPL Copilot helps you interpret the law's data categories, apply consent and separate-consent rules, run the cross-border analysis against Article 38 and the 2024 Provisions, draft notices, impact assessments and breach notifications, and answer rights requests. It is advisory documentation support in Chinese or English, not a law firm and not legal advice. The dedicated China framework knowledge modules ship with the next product release; Chinese-language answers about PIPL work today.

Article 38 lists the conditions: a CAC-organised security assessment, personal information protection certification, the CAC standard contract with the overseas recipient, or other conditions set by law or CAC rules, with an international-treaty route alongside. The 2024 Provisions (CAC Order No. 16, in force 22 March 2024) set the operative volumes: security assessment for critical information infrastructure operators, for non-CIIO processors providing important data abroad, and for transfers covering 1,000,000 or more individuals' non-sensitive personal information or 10,000 or more individuals' sensitive personal information in a year; the standard contract or certification for 100,000 to under 1,000,000 non-sensitive or under 10,000 sensitive; and exemptions below 100,000 non-sensitive (non-CIIO only), for contract-necessity cases, cross-border HR management under lawful labor rules, and emergencies. Sources: PIPL via CAC and the 2024 Provisions, https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm (checked 22 October 2026).

Article 66: refusing to correct brings fines up to CNY 1,000,000 for the organisation; serious violations bring confiscation of illegal gains and a fine of up to CNY 50,000,000 or 5% of the prior year's turnover, possible business suspension, and revocation of licences or business registration, with personal fines up to CNY 1,000,000 and profession bans for the directly responsible persons.

They form one stack. The Cybersecurity Law (revised consolidated text in force 1 January 2026) sets network-operator and Multi-Level Protection Scheme duties; the Data Security Law sets data-management duties including the important-data regime; PIPL is the personal-data layer. Most China programmes need all three, plus the cross-border routes for transfers. See /regions/china for the full picture.