{"id":348,"date":"2021-11-03T13:09:30","date_gmt":"2021-11-03T12:09:30","guid":{"rendered":"https:\/\/stage.usercentrics.com\/?post_type=knowledge&#038;p=16851"},"modified":"2025-06-26T10:10:19","modified_gmt":"2025-06-26T08:10:19","slug":"china-personal-information-protection-law","status":"publish","type":"knowledge","link":"https:\/\/usercentrics.com\/us\/knowledge-hub\/china-personal-information-protection-law\/","title":{"rendered":"China\u2019s Personal Information Protection Law &#8211; An Overview of PIPL"},"content":{"rendered":"\n\n<h2 class=\"wp-block-heading\">What is the Personal Information Protection Law?<\/h2>\n<p>The Personal Information Protection Law of the People\u2019s Republic of China (we will use the shorter Personal Information Protection Law or PIPL) is a federal data privacy law that was passed on August 20th, 2021, and went into effect November 1st, 2021. The PIPL complements the Data Security Law (DSL) passed in June 2021. The PIPL is designed to protect the privacy and personal information of Chinese citizens, and will require compliance initiatives on the part of Chinese organizations and foreign companies operating in China.<\/p>\n<p>Companies that already comply with other international privacy laws, such as the <a href=\"https:\/\/gdpr.eu\" target=\"_blank\" rel=\"noopener\">General Data Protection Regulation (GDPR)<\/a> in the European Union, have already done much of the work necessary for PIPL compliance.<\/p>\n\n\n<h2 class=\"wp-block-heading\">Individuals and handlers under the Personal Information Protection Law<\/h2>\n<p>The Personal Information Protection Law provides legal protection to \u201cnatural persons\u201d, who, throughout the law\u2019s text, are commonly referred to as \u201cindividuals\u201d. This is the same as in Canada\u2019s proposed privacy law, the Canada Consumer Protection Act (CPPA). The term has the same meaning here as \u201cdata subjects\u201d, which is used in a number of other international privacy laws. It simply means those natural persons whose data may be collected and used by organizations, and whose consent for that collection and use must be obtained in many cases.<\/p>\n<p>In the <a href=\"https:\/\/digichina.stanford.edu\/work\/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021\/\" target=\"_blank\" rel=\"noopener\">PIPL<\/a>, the collection, processing, sharing, storage, etc. of personal information are referred to as \u201chandling\u201d. In the same vein, entities carrying out handling are referred to as \u201cpersonal information handlers\u201d or PIH. <a href=\"https:\/\/digichina.stanford.edu\/work\/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021\/\" target=\"_blank\" rel=\"noopener\">Article 73<\/a> defines PIH as: \u201c<em>organizations and individuals that, in personal information handling activities, autonomously decide handling purposes.<\/em>\u201d So while it is reasonable to expect most data handling to be done by companies, the PIPL does also apply to other entities. Per Article 72, the PIPL does not apply to natural persons who are handling personal information for family or personal reasons.<\/p>\n\n\n<div id=\"uc-cta_69e94bce38b3a\" class=\"uc-cta uc-cta--illustration uc-cta--primary uc-ctx--blue\">\n    <div class=\"uc-cta__inner container\">\n        <div class=\"uc-cta__content\">\n                            <div class=\"uc-cta__label like-label-m\">Website Audit<\/div>\n                                        <div class=\"uc-cta__heading no-default-margin\">Is your website privacy-compliant? Find out now!<\/div>\n                                        <div class=\"uc-cta__description\">\n                    <p>Find out your website\u2019s cookie compliance risk level in moments.<\/p>\n                <\/div>\n                                                    <div class=\"uc-cta__buttons\">\n                    <a id=\"f0ac35c2-c54f-49e4-8cc5-c1064ac587db\" class=\"uc-button uc-button-size-m uc-button-contained  no-default-link-decoration\" href=\"https:\/\/usercentrics.com\/data-privacy-audit\/\" target=\"\"><span>Start now!<\/span><\/a>                <\/div>\n                                            <\/div>\n                            <div class=\"uc-cta__section\">\n                                                                    <div class=\"uc-cta__section__img-wrapper\">\n                                <img loading=\"lazy\" decoding=\"async\" width=\"1\" height=\"1\" src=\"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2021\/08\/Audit-1-1.png\" class=\"attachment-large size-large\" alt=\"icon Audit\" \/>                            <\/div>\n                                                            <\/div>\n            <\/div>\n<\/div>\n    <script type=\"module\">\n        new Uc_Cta(document.getElementById(\"uc-cta_69e94bce38b3a\"));\n    <\/script>\n\n\n<p>\u201cPersonal information handler\u201d is a comparable definition to \u201cdata controller\u201d in other international privacy laws like the GDPR. I.e. it refers to the entities initiating collection of data, obtaining consent where needed, arranging data processing, contracting with third parties to process data, etc.<\/p>\n\n\n<h2 class=\"wp-block-heading\">The Personal Information Protection Law and consent<\/h2>\n<p>Another similarity to the GDPR is that there are several legal bases for handling individuals&#8217; personal information. Obtaining consent from the data subjects is one of these, but the other six do not require the subject\u2019s consent.<\/p>\n<p>Under <a href=\"https:\/\/digichina.stanford.edu\/work\/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021\/\" target=\"_blank\" rel=\"noopener\">Section 1, Article 13<\/a>, personal information may only be handled if the personal information handler conforms to at least one of the following:<\/p>\n<ol>\n<li>Obtaining individuals\u2019 consent;<\/li>\n<li>Where necessary to conclude or fulfill a contract in which the individual is an interested party, or where necessary to conduct human resources management according to lawfully formulated labor rules and structures and lawfully concluded collective contracts;<\/li>\n<li>Where necessary to fulfill statutory duties and responsibilities or statutory obligations;<\/li>\n<li>Where necessary to respond to sudden public health incidents or protect natural persons\u2019 lives and health, or the security of their property, under emergency conditions;<\/li>\n<li>Handling personal information within a reasonable scope to implement news reporting, public opinion supervision, and other such activities for the public interest;<\/li>\n<li>When handling personal information disclosed by persons themselves or otherwise already lawfully disclosed, within a reasonable scope in accordance with the provisions of this Law.<\/li>\n<li>Other circumstances provided in laws and administrative regulations.<\/li>\n<\/ol>\n<p>Unlike the GDPR, the PIPL does not have a provision comparable to \u201clegitimate interest\u201d, which enables entities to process personal information without obtaining the data subjects\u2019 consent first, as long as the information is collected legally and there is a justifiable reason for its use.<\/p>\n<p>For individuals\u2019 consent to be considered valid, per Section 1, Article 14, it must be given with full knowledge as well as voluntarily and explicitly. Separate consent or written consent are to be obtained in legal or administrative circumstances where this is required. Per Article 15, Individuals\u2019 consent must also be revocable at any time.<\/p>\n<p>If the purposes for the collection of personal information, the handling method, or the categories of handled personal information change, new consent must be obtained from individuals to reflect these changes.<\/p>\n\n\n<h2 class=\"wp-block-heading\">Individuals\u2019 rights under the Personal Information Protection Law<\/h2>\n<p><a href=\"https:\/\/digichina.stanford.edu\/work\/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021\/\" target=\"_blank\" rel=\"noopener\">Chapter 4 (Articles 44-50)<\/a> outline individuals\u2019 rights under the PIPL, unless other legal or administrative regulation takes precedence:<\/p>\n<ul>\n<li>Right to know what personal information a handler has on them<\/li>\n<li>Right to object to processing of personal information<\/li>\n<li>Right to access and copy personal information<\/li>\n<li>Right to data portability<\/li>\n<li>Right to correct inaccurate information<\/li>\n<li>Right to supplement incomplete information<\/li>\n<li>Right to deletion<\/li>\n<li>Right to have personal information handlers explain personal information handling rules<\/li>\n<li>Private right of action<\/li>\n<\/ul>\n<p>Interestingly, individuals have the right to sue for multiple reasons. They can file suit if their rights are infringed upon, e.g. if they make a legitimate request that is denied, or if the handler violates their rights another way. Chinese authorities may get involved if a handler violates the rights or causes damages to a large group of people (this has not been defined in detail in the PIPL), and may initiate the equivalent of civil prosecution on the public\u2019s behalf against the handler.<\/p>\n<p>Companies cannot refuse to do business with individuals who do not consent to handling of their personal information.<\/p>\n\n\n<h2 class=\"wp-block-heading\">Who has to comply with the Personal Information Protection Law?<\/h2>\n<p>Chapter 1, Article 3, outlines that the PIPL applies to \u201c<em>the activities of handling the personal information of natural persons within the borders of the People\u2019s Republic of China<\/em>\u201d. However, like the GDPR and some other laws, it is also extra territorial in scope, applying to handling of Chinese individuals\u2019 personal information outside China\u2019s borders if:<\/p>\n<ul>\n<li>the purpose is to provide products or services to natural persons inside the borders<\/li>\n<li>when \u201canalyzing or assessing activities of natural persons inside the borders\u201d, or<\/li>\n<li>other circumstances provided in laws or administrative regulations<\/li>\n<\/ul>\n<p>It won\u2019t be known how broadly Chinese regulators apply these provisions until the PIPL has been in effect for a while, however.<\/p>\n<p>The Personal Information Protection Law does not have thresholds for compliance, like the <a href=\"https:\/\/usercentrics.com\/knowledge-hub\/california-consumer-privacy-act\/\">California Consumer Protection Act (CCPA)<\/a>. So handlers are required to comply regardless of the company\u2019s revenue or how many individuals\u2019 data they process in a given year.<\/p>\n\n\n<h2 class=\"wp-block-heading\">How does the Personal Information Protection Law define personal information and handling?<\/h2>\n<p>Article 4 defines personal information as \u201call kinds of information, recorded by electronic or other means, related to identified or identifiable natural persons. It does not include information that has been anonymized. (Learn more: <a href=\"https:\/\/usercentrics.com\/knowledge-hub\/data-anonymization\/\">Data Anonymization: The What, Why, and How of Data Anonymization<\/a>.)<\/p>\n<p>This differs from many other laws by not explicitly providing examples like name, email address, driver\u2019s licence number, health records, etc. But with this wording it provides broad enough coverage that it won\u2019t require frequent updating, e.g. as technologies change.<\/p>\n<p>Further, the PIPL defines personal information handling as \u201ccollection, storage, use, processing, transmission, provision, disclosure, deletion, etc.\u201d<\/p>\n\n\n<h2 class=\"wp-block-heading\">How does the Personal Information Protection Law define sensitive personal information?<\/h2>\n<p>Like many current privacy laws, the PIPL directly addresses the issue of personal information of a more sensitive nature, or belonging to children. <a href=\"https:\/\/digichina.stanford.edu\/work\/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021\/\" target=\"_blank\" rel=\"noopener\">Article 28<\/a> states:<\/p>\n<blockquote><p><em>\u201c&#8230;personal information that, once leaked or illegally used, may easily cause harm to the dignity of natural persons grave harm to personal or property security, including information on biometric characteristics, religious beliefs, specially-designated status, medical health, financial accounts, individual location tracking, etc., as well as the personal information of minors under the age of 14.\u201d<\/em><\/p><\/blockquote>\n<p>Separate explicit consent must be obtained from individuals \u2013 or a child\u2019s parent\/guardian \u2013 before handling sensitive personal information. There must also be a clear \u201cspecific purpose and need to fulfill\u201d in place with \u201cstrict protection measures\u201d as well as additional disclosures to individuals whose sensitive personal information would be handled, as noted in Articles 28 and 30.<\/p>\n\n\n<h2 class=\"wp-block-heading\">Companies\u2019 obligations under the Personal Information Protection Law<\/h2>\n<p>Per <a href=\"https:\/\/digichina.stanford.edu\/work\/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021\/\" target=\"_blank\" rel=\"noopener\">Article 17<\/a>, personal information handlers must notify individuals prior to handling their personal information \u201ctruthfully, accurately, and fully\u2026 using clear and easily understood language\u201d . This includes provision of:<\/p>\n<ul>\n<li>Personal information handler\u2019s name<\/li>\n<li>Contact method for the PIH<\/li>\n<li>The categories of personal information to be handled<\/li>\n<li>The purpose(s) of handling<\/li>\n<li>The retention period<\/li>\n<li>Methods for individuals to exercise their data privacy rights (Article 17)<\/li>\n<li>Any other requirements per legal or administrative regulations<\/li>\n<\/ul>\n<p>Data retention periods should be \u201cthe shortest period necessary\u201d to complete the purpose for personal information handling, per Article 19. Though other relevant legal or administrative regulations may affect the length of the retention period.<\/p>\n<p>Per Article 25, personal information handlers cannot disclose the data they handle, except in cases where separate explicit consent is obtained.<\/p>\n<p>Handlers must implement security measures to protect information from breaches or other unauthorized exposure, as well as conducting data protection impact assessments for certain processing activities. In a number of circumstances they must appoint a data protection officer. If the information handling entity is located outside of China, similar to the GDPR, they must appoint a representative in China, and regular audits of practices relating to data handling must be conducted.<\/p>\n<p>Handlers must also seek approval from Chinese authorities regarding providing any personal information they handle, that is stored in China, to any foreign judicial or law enforcement authority. The law does not specify further details on the scope of this requirement or how approvals would be dealt with, however.<\/p>\n<p>Interestingly, <a href=\"https:\/\/digichina.stanford.edu\/work\/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021\/\" target=\"_blank\" rel=\"noopener\">Article 58<\/a> directly explicitly addresses personal information handlers that provide \u201cimportant Internet platform services\u201d with large user bases, and that have complex business models. Their obligations:<\/p>\n<ol>\n<li>Establish and complete personal information protection compliance systems and structures according to State regulations, and establish an independent body composed mainly of outside members to supervise personal information protection circumstances;<\/li>\n<li>Abide by the principles of openness, fairness, and justice; formulate platform rules; and clarify the standards for intra-platform product or service providers&#8217; handling of personal information and their personal information protection duties;<\/li>\n<li>Stop providing services to product or service providers on the platform that seriously violate laws or administrative regulations in handling personal information;<\/li>\n<li>Regularly release personal information protection social responsibility reports, and accept society\u2019s supervision.<\/li>\n<\/ol>\n<p>However, sites like Facebook, YouTube, and Instagram, which have large presences and massive user bases elsewhere in the world, are blocked in China<\/p>\n\n\n<h2 class=\"wp-block-heading\">Exemptions to Personal Information Protection Law compliance<\/h2>\n<p>Handlers can be exempt from providing clear and timely notification to individuals in some cases, like under emergency circumstances to protect natural persons\u2019 lives, health, or security and that of their property. However, once the emergency has concluded, handlers must then provide the required notification and information.<\/p>\n<p>As noted, anonymized information is not classified the same way or subject to the same legal bases and other requirements, in many cases, as personal information that remains identifiable.<\/p>\n\n\n<h2 class=\"wp-block-heading\">Data processing agreements under the Personal Information Protection Law<\/h2>\n<p>If personal information handlers transfer individuals\u2019 personal information to third parties, or \u201centrusted persons\u201d, <a href=\"https:\/\/digichina.stanford.edu\/work\/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021\/\" target=\"_blank\" rel=\"noopener\">Article 21<\/a> outlines that \u201cthey should conclude an agreement\u201d for:<\/p>\n<ul>\n<li>The purpose for \u201centrusted handling\u201d<\/li>\n<li>The time limit<\/li>\n<li>The handling method<\/li>\n<li>Categories of personal information to be included<\/li>\n<li>Protection measures<\/li>\n<li>Rights and duties of both sides<\/li>\n<\/ul>\n<p>The handler should also supervise the personal information handling activities of any entrusted persons. The entrusted persons are also legally required to adhere to the contractual terms, to return the personal information at the conclusion of the relationship, and cannot transfer any personal information to additional parties without consent of the original handler.<\/p>\n\n\n<h2 class=\"wp-block-heading\">International data transfers under the Personal Information Protection Law<\/h2>\n<p>International transfer of personal information is extensively covered in <a href=\"https:\/\/digichina.stanford.edu\/work\/translation-personal-information-protection-law-of-the-peoples-republic-of-china-effective-nov-1-2021\/\" target=\"_blank\" rel=\"noopener\">Chapter 3 (Articles 38-43)<\/a>, similarly to the GDPR. Handlers must meet at least one of the following conditions:<\/p>\n<ul>\n<li>Passing a security assessment organized by the State cybersecurity and informatization department according to Article 40;<\/li>\n<li>Undergoing personal information protection certification conducted by a specialized body according to provisions by the State cybersecurity and informatization department;<\/li>\n<li>Concluding a contract with the foreign receiving side in accordance with a standard contract formulated by the State cyberspace and informatization department, agreeing upon the rights and responsibilities of both sides;<\/li>\n<li>Other conditions provided in laws or administrative regulations or by the State cybersecurity and informatization department.<\/li>\n<\/ul>\n<p>Other agreements or treaties can also include coverage to enable international data transfer as well.<\/p>\n<p>Handlers providing personal information outside of China must notify individuals of:<\/p>\n<ul>\n<li>The receiving entity or entity contact\u2019s name<\/li>\n<li>Contact method<\/li>\n<li>Categories of personal information<\/li>\n<li>Handling purpose<\/li>\n<li>Handling methods<\/li>\n<li>Procedures for individuals to exercise their rights with the foreign entity<\/li>\n<\/ul>\n\n\n<h2 class=\"wp-block-heading\">Handling of a data breach under the Personal Information Protection Law<\/h2>\n<p>In the event that a \u201cleak, distortion, or loss occurs or might have occurred\u201d, handlers must immediately take action and notify the personnel and departments responsible for personal information protection, as well as affected individuals. The notification must include:<\/p>\n<ol>\n<li>The information categories, causes, and possible harm caused by the leak, distortion, or loss that occurred or might have occurred;<\/li>\n<li>The remedial measures taken by the personal information handler and measures individuals can adopt to mitigate harm;<\/li>\n<li>Contact method of the personal information handler.<\/li>\n<\/ol>\n\n\n<h2 class=\"wp-block-heading\">Personal Information Protection Law enforcement and penalties<\/h2>\n<p>Where violations of personal information handling occur, or when there are violations or failures of the protection duties for handling, and if correction is refused, departments responsible can be fined up to RMB 1 million, and directly responsible personnel can be fined between RMB 10,000 and 100,000 (a bit more than US $1,500 to $15,000). Additionally, the responsible entities must:<\/p>\n<ul>\n<li>Order correction<\/li>\n<li>Confiscate unlawful income<\/li>\n<li>Order provisional suspension or termination programs unlawfully handling the information<\/li>\n<\/ul>\n<p>For \u201cgrave circumstances\u201d of unlawful handling, Chinese regulators can issue fines of up to RMB 50 million (approx. US $7.7 million) or up to 5 percent of the handler\u2019s previous year\u2019s gross revenue. (It is not specified if this is Chinese-only or global revenue.) Handlers found to have committed violations may have their operations or business licence suspended or terminated. Apps can also be ordered removed from app stores.<\/p>\n<p>Personnel found to be directly responsible are to be fined between RMB 100,000 and 1 millon (approx. US $15,000 and $150,000). They can also be prohibited from holding \u201cdirector, supervisor, high-level manager, or personal information protection officer\u201d positions for a<\/p>\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n<p>With both the Data Security Law and the Personal Information Protection Law passed this year, China has instituted a strong framework to direct the activities of domestic and foreign companies with regards to data protection, and to protect the rights of Chinese individuals. While the PIPL contains many similarities to the GDPR, on several fronts it is more strict, and it will surely continue to develop over time with evolving technology, consumer expectations, and legal thought. Companies wanting to enter the large Chinese market should definitely consult with qualified legal counsel.<\/p>\n<p>Do you have questions about how China&#8217;s privacy law could affect your business? <a href=\"https:\/\/usercentrics.com\/book-a-consultation\/\">Contact one of our experts<\/a>!<\/p>\n\n\n<div id=\"uc-cta_69e94bce3a278\" class=\"uc-cta uc-cta--illustration uc-cta--primary uc-ctx--blue\">\n    <div class=\"uc-cta__inner container\">\n        <div class=\"uc-cta__content\">\n                            <div class=\"uc-cta__label like-label-m\">Pricing plans<\/div>\n                                        <div class=\"uc-cta__heading no-default-margin\">The right plan for your growing business<\/div>\n                                        <div class=\"uc-cta__description\">\n                    <p>We have the right solutions to help enterprises achieve data compliance.<\/p>\n                <\/div>\n                                                    <div class=\"uc-cta__buttons\">\n                    <a id=\"5d9e92b6-ea86-4ea6-bcb9-39898e0b281e\" class=\"uc-button uc-button-size-m uc-button-contained  no-default-link-decoration\" href=\"https:\/\/usercentrics.com\/pricing\/\" target=\"\"><span>Get started<\/span><\/a>                <\/div>\n                                            <\/div>\n                            <div class=\"uc-cta__section\">\n                                                                    <div class=\"uc-cta__section__img-wrapper\">\n                                <img loading=\"lazy\" decoding=\"async\" width=\"1\" height=\"1\" src=\"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2021\/08\/icon-Article.png\" class=\"attachment-large size-large\" alt=\"icon Article\" \/>                            <\/div>\n                                                            <\/div>\n            <\/div>\n<\/div>\n    <script type=\"module\">\n        new Uc_Cta(document.getElementById(\"uc-cta_69e94bce3a278\"));\n    <\/script>\n\n\n","protected":false},"excerpt":{"rendered":"<p>We look at what China\u2019s Personal Information Protection Law means for the data privacy rights of citizens and for companies\u2019 responsibilities.<\/p>\n","protected":false},"featured_media":2100,"template":"","meta":{"_acf_changed":false,"editor_notices":[],"footnotes":""},"tags":[],"magazine_issue":[],"magazine_tag":[],"resource_tag":[14,13],"class_list":["post-348","knowledge","type-knowledge","status-publish","has-post-thumbnail","hentry","resource_tag-privacy","resource_tag-regulations"],"acf":[],"yoast_head":"<title>China\u2019s Personal Information Protection Law | PIPL Overview<\/title>\n<meta name=\"description\" content=\"We look at what China\u2019s Personal Information Protection (PIPL) Law means for the data privacy rights of its citizens and for companies\u2019 responsibilities.\" \/>\n<meta name=\"robots\" content=\"noindex, follow\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"China\u2019s Personal Information Protection Law | PIPL Overview\" \/>\n<meta property=\"og:description\" content=\"We look at what China\u2019s Personal Information Protection Law means for the data privacy rights of its citizens and for companies\u2019 responsibilities.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/usercentrics.com\/us\/knowledge-hub\/china-personal-information-protection-law\/\" \/>\n<meta property=\"og:site_name\" content=\"Usercentrics - US\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/usercentrics\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-26T08:10:19+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/usercentrics.com\/wp-content\/uploads\/2021\/11\/PIPL.jpg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"China\u2019s Personal Information Protection Law | PIPL Overview\" \/>\n<meta name=\"twitter:description\" content=\"We look at what China\u2019s Personal Information Protection Law means for the data privacy rights of its citizens and for companies\u2019 responsibilities.\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/usercentrics.com\/wp-content\/uploads\/2021\/11\/PIPL.jpg\" \/>\n<meta name=\"twitter:site\" content=\"@usercentrics\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"11 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/china-personal-information-protection-law\\\/\",\"url\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/china-personal-information-protection-law\\\/\",\"name\":\"China\u2019s Personal Information Protection Law | PIPL Overview\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/china-personal-information-protection-law\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/china-personal-information-protection-law\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/wp-content\\\/uploads\\\/sites\\\/7\\\/2021\\\/11\\\/Chinas-Personal-Information-Protection-Law-\u2013-An-Overview-of-PIPL.svg?v=f2e1e3a4c353c5bb\",\"datePublished\":\"2021-11-03T12:09:30+00:00\",\"dateModified\":\"2025-06-26T08:10:19+00:00\",\"description\":\"We look at what China\u2019s Personal Information Protection (PIPL) Law means for the data privacy rights of its citizens and for companies\u2019 responsibilities.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/china-personal-information-protection-law\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/china-personal-information-protection-law\\\/\"}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/china-personal-information-protection-law\\\/#primaryimage\",\"url\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/wp-content\\\/uploads\\\/sites\\\/7\\\/2021\\\/11\\\/Chinas-Personal-Information-Protection-Law-\u2013-An-Overview-of-PIPL.svg?v=f2e1e3a4c353c5bb\",\"contentUrl\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/wp-content\\\/uploads\\\/sites\\\/7\\\/2021\\\/11\\\/Chinas-Personal-Information-Protection-Law-\u2013-An-Overview-of-PIPL.svg?v=f2e1e3a4c353c5bb\",\"caption\":\"China\u2019s Personal Information Protection Law \u2013 An Overview of PIPL\",\"copyrightNotice\":\"\u00a9 Copyright 2026 Usercentrics GmbH\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Usercentrics GmbH\"},\"creditText\":\"Image: Usercentrics GmbH\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/china-personal-information-protection-law\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Resources\",\"item\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/resources\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Blog\",\"item\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"China\u2019s Personal Information Protection Law - An Overview of PIPL\",\"item\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/knowledge-hub\\\/china-personal-information-protection-law\\\/\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/#website\",\"url\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/\",\"name\":\"Usercentrics - US\",\"description\":\"Consent Management Platform (CMP) Usercentrics\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/usercentrics.com\\\/us\\\/?s={search_term_string}\"}}],\"inLanguage\":\"en-US\"}]}<\/script>","yoast_head_json":{"title":"China\u2019s Personal Information Protection Law | PIPL Overview","description":"We look at what China\u2019s Personal Information Protection (PIPL) Law means for the data privacy rights of its citizens and for companies\u2019 responsibilities.","robots":{"index":"noindex","follow":"follow"},"og_locale":"en_US","og_type":"article","og_title":"China\u2019s Personal Information Protection Law | PIPL Overview","og_description":"We look at what China\u2019s Personal Information Protection Law means for the data privacy rights of its citizens and for companies\u2019 responsibilities.","og_url":"https:\/\/usercentrics.com\/us\/knowledge-hub\/china-personal-information-protection-law\/","og_site_name":"Usercentrics - US","article_publisher":"https:\/\/www.facebook.com\/usercentrics","article_modified_time":"2025-06-26T08:10:19+00:00","og_image":[{"url":"https:\/\/usercentrics.com\/wp-content\/uploads\/2021\/11\/PIPL.jpg","type":"","width":"","height":""}],"twitter_card":"summary_large_image","twitter_title":"China\u2019s Personal Information Protection Law | PIPL Overview","twitter_description":"We look at what China\u2019s Personal Information Protection Law means for the data privacy rights of its citizens and for companies\u2019 responsibilities.","twitter_image":"https:\/\/usercentrics.com\/wp-content\/uploads\/2021\/11\/PIPL.jpg","twitter_site":"@usercentrics","twitter_misc":{"Est. reading time":"11 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/china-personal-information-protection-law\/","url":"https:\/\/usercentrics.com\/us\/knowledge-hub\/china-personal-information-protection-law\/","name":"China\u2019s Personal Information Protection Law | PIPL Overview","isPartOf":{"@id":"https:\/\/usercentrics.com\/us\/#website"},"primaryImageOfPage":{"@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/china-personal-information-protection-law\/#primaryimage"},"image":{"@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/china-personal-information-protection-law\/#primaryimage"},"thumbnailUrl":"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2021\/11\/Chinas-Personal-Information-Protection-Law-\u2013-An-Overview-of-PIPL.svg?v=f2e1e3a4c353c5bb","datePublished":"2021-11-03T12:09:30+00:00","dateModified":"2025-06-26T08:10:19+00:00","description":"We look at what China\u2019s Personal Information Protection (PIPL) Law means for the data privacy rights of its citizens and for companies\u2019 responsibilities.","breadcrumb":{"@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/china-personal-information-protection-law\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":"https:\/\/usercentrics.com\/us\/knowledge-hub\/china-personal-information-protection-law\/"}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/china-personal-information-protection-law\/#primaryimage","url":"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2021\/11\/Chinas-Personal-Information-Protection-Law-\u2013-An-Overview-of-PIPL.svg?v=f2e1e3a4c353c5bb","contentUrl":"https:\/\/usercentrics.com\/us\/wp-content\/uploads\/sites\/7\/2021\/11\/Chinas-Personal-Information-Protection-Law-\u2013-An-Overview-of-PIPL.svg?v=f2e1e3a4c353c5bb","caption":"China\u2019s Personal Information Protection Law \u2013 An Overview of PIPL","copyrightNotice":"\u00a9 Copyright 2026 Usercentrics GmbH","creator":{"@type":"Organization","name":"Usercentrics GmbH"},"creditText":"Image: Usercentrics GmbH"},{"@type":"BreadcrumbList","@id":"https:\/\/usercentrics.com\/us\/knowledge-hub\/china-personal-information-protection-law\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Resources","item":"https:\/\/usercentrics.com\/us\/resources\/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https:\/\/usercentrics.com\/us\/knowledge-hub\/"},{"@type":"ListItem","position":3,"name":"China\u2019s Personal Information Protection Law - An Overview of PIPL","item":"https:\/\/usercentrics.com\/us\/knowledge-hub\/china-personal-information-protection-law\/"}]},{"@type":"WebSite","@id":"https:\/\/usercentrics.com\/us\/#website","url":"https:\/\/usercentrics.com\/us\/","name":"Usercentrics - US","description":"Consent Management Platform (CMP) Usercentrics","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/usercentrics.com\/us\/?s={search_term_string}"}}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/knowledge\/348","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/knowledge"}],"about":[{"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/types\/knowledge"}],"version-history":[{"count":0,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/knowledge\/348\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/media\/2100"}],"wp:attachment":[{"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/media?parent=348"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/tags?post=348"},{"taxonomy":"magazine_issue","embeddable":true,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/magazine_issue?post=348"},{"taxonomy":"magazine_tag","embeddable":true,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/magazine_tag?post=348"},{"taxonomy":"resource_tag","embeddable":true,"href":"https:\/\/usercentrics.com\/us\/wp-json\/wp\/v2\/resource_tag?post=348"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}