China Privacy Law PIPL requirements

Personal information is recorded information about an identified or identifiable natural person. PIPL excludes information after genuine anonymization, which means the person cannot be identified and the result cannot be restored. De-identification is different: it prevents identification without additional information, but the information remains within PIPL while that additional information can restore the link. Processing solely for personal or family affairs is excluded. PIPL was adopted on 20 August 2021 and has applied since 1 November 2021.

A processor may process personal information only under one of Article 13's conditions. These include consent; necessity for an individual's contract or qualifying human-resources management; legal duties; specified public-health or life, health, and property emergencies; public-interest news or supervision within a reasonable scope; legally public information within the permitted scope; and other conditions set by law or administrative regulation.

Before processing, give a prominent, clear, accurate, and complete notice naming the processor and stating its contact details, purposes, methods, information categories, retention, and rights procedure. A rules document used for notice must be public and easy to consult and save.

When consent is the Article 13 condition, it must be informed, voluntary, and explicit. Provide a convenient withdrawal method and obtain new consent if the purpose, method, or personal-information categories change. When consent is the processing condition, separate consent is required for the PIPL activities that expressly call for it, including disclosure to another processor, public disclosure, sensitive-information processing, and overseas provision.

The processor must use safeguards suited to the purpose, method, categories, effect on rights, and security risk. Article 51 lists internal rules, classification, appropriate encryption or de-identification, access controls, staff training, and an incident plan.

Conduct periodic compliance audits. Under the Personal Information Protection Compliance Audit Measures, effective 1 May 2025, a processor handling personal information of 10 million or more individuals must audit at least once every two years. The Cyberspace Administration of China's (CAC) April 2026 Q&A clarifies that the threshold includes 10 million and counts individuals currently covered, excluding deleted information. Other audit intervals depend on the applicable rules, including the annual rule for minors' personal information and the simplified rules for qualifying small processors; use the compliance calendar to select the relevant interval.

Complete a PIPIA before processing sensitive information, automated decision-making, entrusted processing, providing information to another processor, public disclosure, overseas provision, or other processing with a major effect on individual rights. Assess legality, necessity, effect, risk, and the adequacy of safeguards, and keep the assessment and processing record for at least three years.