← Global Privacy Laws Research Library
Personal Information Protection Law of the People's Republic of China
Personal Information Protection Law of the People's Republic of China: PIPL
Prepared by Shubhank Suman · Last reviewed
Current. (Supreme People's Procuratorate)
- Legal character
- National law
- Region
- Asia-Pacific
- Adopted
- 20 August 2021
- Effective
- 1 November 2021
What it covers
The PIPL is China's comprehensive personal-information protection statute.
Its structure covers:
- general principles
- processing rules
- sensitive personal information
- state-organ processing
- cross-border transfers
- individual rights
- processor obligations
- regulatory supervision
- sanctions.
The official text's Chapter structure confirms these components. (Supreme People's Procuratorate)
AI, privacy and cybersecurity relevance
- AI: Very High
- Privacy: Very High
- Cyber: Very High
AI
Very High
Article 24 is one of the most important AI/privacy provisions in the global library.
For automated decision-making, processors must:
- ensure transparency
- ensure fairness and impartiality
- avoid unreasonable differential treatment
- provide non-personalised options for certain information pushes/marketing
- allow individuals to request an explanation
- allow refusal of decisions made solely through automated decision-making where significant effects are involved. (Supreme People's Procuratorate)
Privacy
Very High
Important provisions include:
Article 3: territorial scope Articles 4–12: definitions and general principles Articles 13–17: lawful processing and notice/consent Article 19: retention limitation Articles 20–23: joint processing, entrusted processing and third-party provision Article 28 onward: sensitive personal information Articles 31 onward: minors Articles 37 onward: cross-border provision Articles 44–50: data-subject rights Articles 51–59: processor obligations and security.
The law applies extraterritorially in specified situations, including offering products/services to persons in China and analysing/evaluating their activities in China. (Supreme People's Procuratorate)
Cybersecurity
Very High
Article 51: security measures. Article 57: breach/tampering/loss notification and remediation. Article 59: security obligations of entrusted processors.
The PIPL also permits regulators to require compliance audits and risk rectification. (Supreme People's Procuratorate)
Current validity
CURRENT: effective 1 November 2021
Read first
Articles 3–9 → Articles 13–24 → Articles 28–31 → Articles 37–43 → Articles 51–59 → Articles 66 onward.
Provisions / sections covered
DPIA relevance
Articles 55–56 require a personal-information protection impact assessment before specified high-risk processing.
Importantly, Article 55 expressly includes:
using personal information for automated decision-making
as a DPIA-triggering circumstance. (Supreme People's Procuratorate)
AI-specific policy connection
Article 62 expressly calls for specialised rules and standards for new technologies and applications, including facial recognition and artificial intelligence. (Supreme People's Procuratorate)
Subject-matter tags
- Lawful basis
- Consent
- Sensitive data
- Data subject rights
- Automated decision-making
- Impact assessment
- Security
- Cross-border transfers
- Data protection officer
- Controller and processor
- Retention
- Enforcement and penalties
- Facial recognition
- Transparency
- AI cybersecurity
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.