cac.gov.cn
Referenced sections
- Binding measure for assessment preparation, filing materials, review steps, legal-instrument content, and reapplication triggers; the 2024 provisions replace its older two-year validity rule with three years.
By Sorena AIPublished Updated
Privacy
China Privacy Law
Plain-language China guide covering territorial scope, processor and vendor roles, consent and sensitive information, , app minimization, incidents, and current cross-border transfer routes.
- PIPL effective
- SCC measures effective
- export assessment effective
- cross-border provisions
Understand China Privacy Law
Decide whether China's Personal Information Protection Law () applies, identify the and entrusted parties, map processing and higher-risk activities, then choose the required controls and current cross-border transfer route.
is a binding national law adopted on 20 August 2021 and effective since 1 November 2021. It applies to processing in China and to specified overseas processing that offers products or services to people in China or analyzes or assesses their behavior. For each activity, document the Article 13 condition, notice, data minimization, retention, rights, security, higher-risk triggers, recipients, and any overseas provision.
Read the guides in decision order. The 22 March 2024 cross-border provisions control where they conflict with the older assessment and standard-contract measures.
Quick scan
1. Scope, data and role
Confirm China or overseas territorial scope and the personal-or-family-affairs exclusion. Distinguish personal information, , de-identified information, and genuinely anonymized information. Identify the , joint processors, entrusted processors, and independent recipients.
2. Processing controls
Assign an Article 13 processing condition and implement purpose limitation, minimum scope, shortest necessary retention, notice, valid consent where used, where required, individual rights, vendor controls, automated-decision rules, security, and incident response.
3. PIPIA and export route
Complete PIPIAs before every Article 55 activity and keep the report and processing record for at least three years. For overseas flows, apply important-data and CIIO checks, then the 2024 exemptions and thresholds before selecting security assessment, standard contract, or certification.
Use this decision order
- 1
Scope, data and role
Confirm China or overseas territorial scope and the personal-or-family-affairs exclusion. Distinguish personal information, , de-identified information, and genuinely anonymized information. Identify the , joint processors, entrusted processors, and independent recipients.
- 2
Processing controls
Assign an Article 13 processing condition and implement purpose limitation, minimum scope, shortest necessary retention, notice, valid consent where used, where required, individual rights, vendor controls, automated-decision rules, security, and incident response.
- 3
PIPIA and export route
Complete PIPIAs before every Article 55 activity and keep the report and processing record for at least three years. For overseas flows, apply important-data and CIIO checks, then the 2024 exemptions and thresholds before selecting security assessment, standard contract, or certification.
Key dates for China Privacy Law
Distinguish adoption, commencement, filing, validity, renewal, and reassessment dates under the binding , app rules, and export measures. For current route decisions, the binding 22 March 2024 cross-border provisions override inconsistent parts of the 2022 assessment and 2023 standard-contract measures; Sorena's reading order and evidence suggestions are explanatory, not additional legal requirements.
Loading timeline...
Choose the next PIPL decision
Start with territorial scope, role and processing basis. Then open the focused guide for consent, sensitive information, apps, vendors, , incidents, exports, deadlines, enforcement or comparisons.
Start here: scope, roles and baseline duties
Decide whether applies, identify the and other parties, and build the processing inventory and control plan.
Processing choices and operating controls
Design notices and choices, protect sensitive information, govern vendors and automated decisions, and prepare breach response.
App minimization
Map the app's real basic functions to the official 39-category necessary-information table, then overlay the full analysis.
PIPIA and cross-border transfers
Document higher-risk processing, apply 2024 exemptions and thresholds, and complete the selected assessment or standard-contract route.
Deadlines and enforcement
Separate historical effective dates from event-driven filing, validity and record-retention periods, then understand the graduated enforcement exposure.
Comparisons and focused questions
Keep China conclusions separate from GDPR, CCPA/CPRA and Singapore PDPA, or open a direct answer for a specific question.
Sources
cac.gov.cn
Referenced sections
- Binding measure for the CAC standard-contract form, pre-export PIPIA, contract effectiveness, filing within 10 working days, and refiling triggers, subject to the controlling 2024 provisions.
cac.gov.cn
Referenced sections
- Use for app provider and app distribution platform governance, content/security/data duties, platform filing and verification, and 1 August 2022 effective date.
cac.gov.cn
Referenced sections
- Use for app category, basic-function, minimum necessary personal information, no-refusal rule, and 1 May 2021 effective date.
cac.gov.cn
Referenced sections
- Binding source for territorial scope, definitions, processing conditions, notice and consent, sensitive information, automated decisions, individual rights, processor and vendor duties, PIPIA, incidents, overseas transfers, penalties, and the 1 November 2021 effective date.
cac.gov.cn
Referenced sections
- Controlling current source for important-data treatment, export exemptions, CIIO and current-year volume thresholds, standard-contract or certification bands, three-year assessment validity, continuing PIPL duties, and precedence over inconsistent earlier measures.
Next steps
Prepare the PIPL and data export evidence file
Sorena AI turns China official requirements into scoped decisions, evidence records, owner assignments, and change-trigger reviews.
- Start with territorial scope, the role, the processing purpose and basis, the affected people, and the complete data flow.
- Research Copilot keeps the official citation, decision owner, evidence record, and approval history connected.
- SSOT preserves notices, consent states, PIPIAs, vendor terms, rights records, incident decisions, transfer routes and their change history.
- Open Research Copilot
Map processing maps, , sensitive PI, entrusted processing, , SCC filings, security assessment, and rights records to official citations, owners, and review checkpoints.
- Open SSOT
Keep official citations, decisions, approvals, and evidence with the relevant product and compliance records.
- Review unresolved triggers
Check unresolved scope, role, sensitive-information, , app-minimization, incident or overseas-transfer questions before processing begins.