PrivacyTerrainStructured privacy law intelligence

apac

China

China's PIPL sits within a broader digital regulation stack, and any public summary needs careful handling of transfer, localization, security review, and sector-specific obligations.

Primary lawPersonal Information Protection Law
Statusin-force
Last reviewed17/04/2026
Coverage qualitycomplex-framework
Confidencemedium
Primary sources1
Secondary sources1
Last checkedUnknown
Freshnessunknown
Review priorityhigh

Editorial caveat

Structured values summarize official materials for research and planning. They are reviewed by humans before publication and should not be treated as legal advice.

medium confidence, Requires dedicated treatment of localization, transfer assessments, security review, and interaction with broader Chinese digital regulation.

At a glance

Key presentation points

A compact summary of high-signal fields before the full structured record.

Effective statusin-force1 primary + 1 secondary • Reviewed 17/04/2026
Territorial scopeApplies domestically and extraterritorially where processing outside China targets individuals in China or serves specified legal purposes.1 primary + 1 secondary • Reviewed 17/04/2026
Regulator or enforcement authority summaryCAC and broader state authorities1 primary • Reviewed 17/04/2026
Requires legal basisYes1 primary + 1 secondary • Reviewed 17/04/2026

Structured record

Regulation details grouped by topic

Each value keeps its field context, linked sources, notes, and review date together to avoid detached or ambiguous statements.

Identity

Effective status
in-forceSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Law status
activeSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Effective date
2021-11-01Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Last amended
2021-11-01Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Scope

Extraterritorial application
YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Territorial scope
Applies domestically and extraterritorially where processing outside China targets individuals in China or serves specified legal purposes.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Private sector coverage
Applies broadly to private-sector personal information handlers.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Public sector coverage
Public authorities are also subject to data and cybersecurity obligations, with additional state-sector requirements.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Definitions

Personal data definition
Personal information means all kinds of information related to identified or identifiable natural persons recorded electronically or otherwise.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Sensitive data recognized
YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Legal bases
consent, contract necessity, HR management, statutory duty, public interestSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Requires legal basis
YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Rights

Right of access
YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Right to deletion
YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Right to object
YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Right to portability
YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Right to appeal
YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Right to erasure or delete summary
Deletion rights in complex regulatory settingSupport: 1 primary • Reviewed 17/04/2026Sources: PIPL text (primary)Note: China's deletion rights should not be separated from the wider PIPL and digital regulation environment.
Right to rectification or correction summary
Correction and supplementation rightsSupport: 1 primary • Reviewed 17/04/2026Sources: PIPL text (primary)Note: China's rights structure includes correction and supplementation language.

Breach

Breach deadline (hours)
0Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Breach notification required
YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Governance

DPO required
YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Impact assessment required
YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Records of processing required
YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Enforcement

Maximum fine
PIPL permits very substantial fines, business suspension risk, and personal liability for responsible individuals.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Private right of action
YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Regulator or enforcement authority summary
CAC and broader state authoritiesSupport: 1 primary • Reviewed 17/04/2026Sources: PIPL text (primary)Note: China's enforcement should be summarized as a multi-authority state framework rather than a single conventional privacy regulator model.

Transfers

Cross-border transfer restricted
YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.
Data localization required
YesSupport: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Marketing

Cookie consent rule
Online tracking is influenced by consent rules, app governance, and broader cybersecurity compliance expectations.Support: 1 primary + 1 secondary • Reviewed 17/04/2026Sources: PIPL text (primary); CAC guidance (secondary)Note: Seeded as part of the APAC expansion wave. Requires follow-up editorial review.

Official sources

Recent change workflow