Overview of the Personal Information Protection Law (PIPL) of China
The Personal Information Protection Law (PIPL) of the People’s Republic of China, enacted on August 20, 2021, and effective November 1, 2021, establishes a comprehensive legal framework for protecting personal information within China. It applies to all organizations handling personal information of natural persons within the country’s borders, including foreign entities operating in China or targeting Chinese consumers. The law builds upon existing regulations such as the Cybersecurity Law (CSL) and the Data Security Law (DSL), aligning with China’s broader efforts to regulate data governance while reflecting distinct cultural and policy priorities compared to Western privacy laws like the GDPR.
The PIPL was developed with input from the European Union’s GDPR, though it diverges in key areas, such as the absence of a ‘legitimate interests’ legal basis for data processing. Instead, consent remains the primary foundation for most data collection activities, particularly for sensitive data or cross-border transfers. The law also introduces strict requirements for automated decision-making systems, including transparency, fairness, and the right to explanations for significant decisions affecting individuals.
Key Provisions and Scope of Application
The PIPL’s scope extends to all entities processing personal information within China, with long-arm jurisdiction applying to foreign organizations that collect data from Chinese individuals for targeted services, behavioral analysis, or other activities. Such entities must establish a dedicated presence in China or appoint a representative to comply with local regulations. Exemptions are limited, though employee data handling is permitted without explicit consent under certain conditions, provided that overseas transfers still require consent.
The law defines personal information as any data that can identify a natural person, excluding anonymized information. Sensitive personal information includes biometrics (such as facial recognition data), religious beliefs, medical records, financial status, location tracking, and data belonging to minors under 14. These categories require heightened protections, including mandatory consent for processing and stricter oversight.
Individuals are granted several rights under the PIPL, including the right to access, correct, delete, and transfer their personal data. Organizations handling data must also ensure transparency in their processing activities, including clear disclosures about purposes, methods, and legal bases for collection.
Automated Decision-Making and Facial Recognition Restrictions
One of the PIPL’s notable features is its explicit regulation of automated decision-making systems, which use algorithms to evaluate or influence individuals based on personal data. Such systems must adhere to principles of transparency, fairness, and non-discrimination. Individuals have the right to opt out of personalized marketing and to receive explanations for decisions that significantly affect their rights or interests, such as credit scoring or employment assessments.
The law imposes additional restrictions on facial recognition technology in public spaces, requiring explicit consent for collection and prohibiting unauthorized surveillance.
Cross-Border Data Transfers and Enforcement Mechanisms
Cross-border transfers of personal data are heavily regulated under the PIPL, requiring prior consent from individuals and compliance with security assessments conducted by Chinese authorities.
Fines can reach 5% of annual turnover for serious breaches, such as unauthorized data transfers or failure to obtain consent. The law also introduces liability for data processors (third parties handling personal information on behalf of organizations) and large processors, including Critical Information Infrastructure Operators (CIIO), which face additional scrutiny due to their systemic importance.
Comparison with Global Privacy Frameworks
While the PIPL shares similarities with the GDPR, such as consent requirements and individual rights, it diverges in critical areas. Unlike the GDPR’s ‘legitimate interests’ basis, the PIPL relies almost exclusively on consent or contractual necessity for data processing. Additionally, the law’s approach to sensitive data is broader, using an open-ended definition rather than a fixed list, which may lead to broader regulatory scope.
For businesses operating in China or handling data from Chinese users, compliance with the PIPL requires robust data governance practices, including purpose limitation, data minimization, and transparency in processing activities.
Required actions
- Article 24: automated decision-making must be transparent, fair and non-discriminatory; offer non-personalised options for marketing and allow people to refuse decisions with major effects and demand an explanation - Article 26: image collection and identification in public places only for public security with clear notice - Conduct a personal-information protection impact assessment before automated decision-making, sensitive data processing or cross-border transfer