PIPL

Who it applies to

Personal information handlers processing personal information in China, and processing outside China to provide products or services to, or analyse the behaviour of, individuals in China.

Key requirements

• A legal basis for processing, usually consent, with separate consent for sensitive data and cross-border transfers.
• Cross-border transfers through a CAC security assessment, standard contract or certification, as applicable.
• Data localisation for critical information infrastructure operators and handlers above set volume thresholds.
• Personal information protection impact assessments for higher-risk processing.
• Individual rights including access, correction, deletion and portability.
• Overseas handlers designate a representative in China.

Breach and incident notification

When a leak, tampering or loss occurs or may occur, the handler must take immediate remedial measures and notify the relevant authorities and affected individuals.

Penalties

Fines of up to RMB 50 million or 5% of the previous year's turnover for serious violations, plus personal fines for responsible managers and possible suspension of business.

Go deeper