Basics of the Personal Information Protection Law
What this domain tests
This domain tests the architecture of China's Personal Information Protection Law (PIPL): what it covers, who it binds, what counts as personal information, and which legal ground justifies processing. Expect precise definitions and careful reading of scope rather than GDPR vocabulary imported wholesale.
Scope and definitions
PIPL was adopted on 20 August 2021 and took effect on 1 November 2021. It has 74 articles and sits alongside the Cybersecurity Law and the Data Security Law.
- Personal information (PI) means information related to an identified or identifiable natural person, recorded electronically or otherwise, excluding anonymized information.
- Sensitive PI covers biometric characteristics, religious beliefs, specific identity, medical health, financial accounts, whereabouts, and PI of minors under 14, plus other PI that may easily harm dignity or personal/property safety if leaked or misused.
- The processor autonomously decides purpose and means; an entrusted party processes only on the processor's behalf and within its instructions.
Principles (Articles 5-9)
Processing must be lawful, legitimate, necessary and in good faith; have a clear, reasonable purpose directly related to the processing; be limited to the minimum scope and shortest retention; be transparent; keep data accurate; and be secured. Accountability is explicit: the processor is responsible for the security of what it processes.
Reach
PIPL applies to processing inside China and, under Article 3, to processing outside China of PI of people in China where the purpose is providing products or services to them or analyzing or evaluating their behavior. Personal or family processing is excluded, as are genuinely anonymized data and, generally, state statistics governed by other rules.
Legal bases (Article 13)
Consent is only one of six grounds. The others are contract necessity, statutory duty, public health or emergency protection, processing lawfully disclosed PI within a reasonable scope, and other statutory situations. Consent must be voluntary and informed, and separate consent is needed for sensitive PI, third-party sharing, public disclosure and cross-border transfer.
Worked example
A French travel app targets users in China, collecting passport numbers and live location. Article 3 applies because it provides services to people in China. Passport and location data are sensitive PI, so separate consent and a specific notice are needed, and the company must appoint a local representative or dedicated body under Article 53.
Traps
- Treating consent as mandatory for every processing activity.
- Calling de-identified data "anonymized"; it remains PI.
- Assuming foreign companies escape PIPL.
- Confusing a processor with an entrusted party.