Personal Information Protection Law of the People's Republic of China

Introduction

The Personal Information Protection Law (PIPL) of the People’s Republic of China, effective November 2021, is China’s comprehensive data privacy law. PIPL establishes rules for the collection, processing, and transfer of personal information.

Key Principles

PIPL requires consent or another lawful basis for processing personal information. Individuals have rights of access, correction, deletion, and portability. Automated decision-making must be transparent and fair.

Cross-Border Transfers

PIPL imposes strict conditions on cross-border personal information transfers, including security assessments for critical information infrastructure operators and entities processing large volumes of data.

Enforcement

Penalties include fines up to 50 million yuan or 5% of annual revenue, suspension of operations, and revocation of licenses. Class actions and representative actions are permitted. Individuals may claim compensation for violations.