The Personal Information Protection Law (PIPL) is China’s comprehensive data-protection statute, effective 2021, governing how personal information of individuals in China is collected, processed, and transferred. It establishes consent and necessity requirements, data-subject rights, security obligations, and strict cross-border transfer controls, with extraterritorial reach and significant penalties. PIPL is a cornerstone of Asia-Pacific data-privacy regulation alongside frameworks like the GDPR.
Content
- PIPL requires a lawful basis (often explicit consent) and data-minimisation for processing, grants rights of access, correction, and deletion, and imposes localisation and security-assessment conditions on cross-border transfers. Its extraterritorial scope means foreign organisations handling the data of people in China must comply, and breaches can attract fines of up to fifty million yuan or five percent of annual turnover.