Compliance Briefing — China Personal Information Protection Law Takes Effect

Executive briefing: The Personal Information Protection Law of the People's Republic of China (PIPL) took effect on 1 November 2021. The comprehensive privacy regime introduces explicit consent rules, processor obligations, and penalties up to 5% of annual revenue for serious violations.

Key provisions

• Data processing legitimacy. Organizations must obtain informed consent, document necessity, or rely on other lawful bases such as contract performance or statutory duties.
• Cross-border transfer controls. Exporters must complete security assessments, certification, or standard contract filings when moving personal information overseas.
• Individual rights. Data subjects gain access, correction, deletion, and portability rights, with mandated response times and appeal channels.

Implementation guidance

• Data inventory. Map personal information flows touching China data subjects, including telemetry, customer support, and analytics pipelines.
• Transfer governance. Evaluate whether security assessments or CAC standard contracts are required for existing cross-border integrations.
• Policy updates. Refresh privacy notices, consent dialogs, and incident response procedures to align with PIPL timelines and penalties.

Enablement moves

• Designate a China representative and establish data protection officer responsibilities where processing thresholds are met.
• Implement request intake tooling that can localize responses and evidence compliance for audits.
• Coordinate with security teams on data localization strategies, encryption key residency, and vendor contract amendments.

Related briefings

Curated signals from the same pillar or overlapping topics.

Compliance · Credibility 85/100 · September 7, 2023

Compliance Briefing — September 7, 2023

Saudi Arabia's PDPL implementing regulations spell out governance, transfer, and DSAR obligations, compelling boards to assign accountable data officers, execute localisation and vendor workstreams, and harden…

Compliance · Credibility 40/100 · November 1, 2021

Compliance Briefing — China’s Personal Information Protection Law takes effect

China’s Personal Information Protection Law entered into force on 1 November 2021, imposing consent, localization, and cross-border transfer restrictions modeled on GDPR-style accountability.

Compliance · Credibility 89/100 · August 20, 2021

Policy Briefing — China Personal Information Protection Law Passed

China’s Personal Information Protection Law (PIPL) took effect on November 1, 2021, requiring clear lawful bases, data localisation and cross-border transfer pathways, strengthened individual rights, and governance…

Compliance · Credibility 86/100 · August 11, 2023

Compliance Briefing — August 11, 2023

India's Digital Personal Data Protection Act 2023 now requires boards to institutionalise privacy governance, build operational playbooks for consent and notice management, and mature DSAR response engines ahead of Data…

Compliance · Credibility 90/100 · September 22, 2023

Compliance Briefing — September 22, 2023

Phase two of Quebec's Law 25 now enforces privacy officer designation, PIA, and incident reporting rules, requiring boards to tighten governance, embed implementation sprints across systems and vendors, and elevate DSAR…

Continue in the Compliance pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

• Third-Party Risk Oversight Playbook — Zeph Tech

  Operationalize OCC, Federal Reserve, EBA, and MAS outsourcing expectations with lifecycle controls, continuous monitoring, and board reporting.

• Compliance Operations Control Room — Zeph Tech

  Implement cross-border compliance operations that satisfy Sarbanes-Oxley, DOJ guidance, EU DORA, and MAS TRM requirements with verifiable evidence flows.

• SOX Modernization Control Playbook — Zeph Tech

  Modernize Sarbanes-Oxley (SOX) compliance by aligning PCAOB AS 2201, SEC management guidance, and COSO 2013 controls with data-driven testing, automation, and board reporting.