PIPL

The Personal Information Protection Law (PIPL) is a comprehensive data privacy regulation enacted in China on August 20, 2021, following the country’s previous data protection framework, the Personal Information Protection Law of the People’s Republic of China (Draft for Comment), which was proposed in 2019. PIPL aims to protect individuals’ personal information, establish a legal framework for data processing, and ensure transparency and accountability in handling personal data.

The law applies to both domestic and foreign entities that collect, use, or transfer personal information within China, including businesses, government agencies, and international organizations. Key provisions include obligations for data controllers to obtain explicit consent before processing personal information, limit the scope of data collection to what is necessary, and ensure data security and protection. Entities must also implement measures to prevent unauthorized access, disclosure, or loss of personal information.

PIPL introduces strict penalties for violations, including fines up to 50 million yuan (approximately $7.2 million USD) or 5% of the entity’s annual revenue, whichever is greater. It also mandates that data subjects have the right to access, correct, delete, or opt out of data processing. Additionally, PIPL requires entities to establish data protection impact assessments for high-risk data processing activities and to cooperate with data protection authorities in investigations.

The law reflects China’s growing emphasis on data sovereignty and privacy rights, aligning with global standards while addressing specific national concerns. It also encourages international cooperation in data protection, particularly for cross-border data transfers. As of its implementation, PIPL has been widely adopted by businesses operating in China, prompting adjustments in data management practices to comply with the new regulations.