IAPP CIPP/CN cheat sheet

Personal Information Protection Law (PIPL) took effect 1 November 2021; it is the first comprehensive national law dedicated to personal information and sits alongside the Cybersecurity Law (2017) and Data Security Law (2021).

PIPL Article 4 defines personal information as information related to an identified or identifiable natural person, excluding anonymized information; anonymization must make re-identification impossible and irreversible.

Sensitive personal information (PIPL Article 28) includes biometric data, religious belief, specific identity, medical health, financial accounts, and location tracking, plus any PI of minors under 14.

Lawful bases under Article 13: consent, contract necessity, statutory duty, public health or emergency, public interest reporting, already-disclosed information processed within reasonable scope, and other laws.

Separate consent is required for processing sensitive PI, providing PI to other processors, public disclosure, cross-border transfer, and use for automated decision-making with significant impact.

Article 24 governs automated decision-making: transparent rules, fair outcomes, no unreasonable differential treatment, and an opt-out or human-explanation right for decisions with significant impact.

PIPL applies extraterritorially where processing outside China serves the purpose of providing products or services to individuals in China or analyzing/evaluating behavior of individuals in China.

The State Council's 2024 Provisions on Promoting and Regulating Cross-Border Data Flows raised thresholds and created free-trade-zone negative lists, softening earlier transfer requirements.

National standards such as GB/T 35273 (Personal Information Security Specification) are voluntary standards but are widely used as de facto compliance benchmarks by regulators and auditors.

PIPL penalties: corrective orders, warnings, confiscation of illegal gains, suspension or termination of service, and fines up to RMB 50 million or 5% of prior-year turnover for serious violations; responsible individuals may be fined up to RMB 1 million.

Enforcement is multi-regulator: the Cyberspace Administration of China (CAC) leads, with MIIT, Ministry of Public Security, SAMR, and PBOC acting within their sectors.

Article 66 serious-violation triggers include unlawful processing causing serious consequences such as large-scale infringement or major data breaches.

The CAC's 2021 and 2022 campaigns targeted app illegal collection of PI; app operators were ordered to rectify and non-compliant apps were removed from stores.

The 2021 Didi case resulted in a RMB 8.026 billion fine and a two-year suspension of new user registration, illustrating national-security-linked enforcement.

The 2022-2023 Ant Group and related fintech penalties (PBOC) show financial regulators enforcing PI and data rules alongside financial regulation.

Data breach notification: PIPL Article 57 requires immediate remedial action and notification to the authority and affected individuals; notification to individuals may be avoided if harm is effectively prevented.

The 2023 and 2024 CAC enforcement actions increasingly focus on cross-border transfer compliance, sensitive PI processing, and children's data.

Administrative penalties are published by regulators and increasingly used as a compliance signal; individuals may also sue under PIPL Article 69 with a fault-based liability standard.

Build a PI inventory and classify data as general PI, sensitive PI, important data, or core data; classification drives consent, security, and transfer obligations.

Consent must be voluntary, explicit, informed, and separate from bundled terms; pre-ticked boxes and default consent are invalid.

Privacy notices must state the processor's identity, purpose, method, categories, retention period, and how individuals exercise rights.

Individual rights under PIPL include access, copy, correction, deletion, withdrawal of consent, data portability, and explanation of automated decisions.

Data Protection Impact Assessments (PIPL Article 55) are required for sensitive PI, automated decision-making, entrusting or providing PI to third parties, public disclosure, and cross-border transfers; records must be kept for at least three years.

A Personal Information Protection Officer is required for processors exceeding a volume threshold set by the CAC (currently 1 million individuals' PI) and must be reported to the regulator.

Data breach response should include containment, internal escalation, regulator notification, individual notification where harm is likely, and post-incident review.

Vendors are 'entrusted parties' under Article 21; contracts must specify purpose, duration, method, data categories, security measures, and prohibit sub-entrusting without consent.

Security measures should follow the Cybersecurity Law Multi-Level Protection Scheme (MLPS 2.0) and the GB/T 35273 standard for PI security controls.

Cross-border transfer mechanisms under PIPL Article 38: CAC security assessment, CAC-filed standard contract, certification by a professional body, or other conditions set by law.

Security assessment is mandatory for data processed by operators of critical information infrastructure (CIIOs), for important data, and for PI of more than 1 million individuals (thresholds adjusted by 2024 Provisions).

Standard contract filing requires a CAC-approved template, a PI protection impact assessment, and filing with the provincial CAC within 10 working days of signing.

The 2024 Provisions allow exemptions for international trade, academic cooperation, and emergency situations, and permit free-trade zones to adopt negative lists.

Data export security assessment applications are filed with the provincial CAC and reviewed by the national CAC; approval is valid for a period (typically 2 years under the 2024 rules).

Important data is defined by sectoral catalogs and regulator designations; absent a designation, data is generally not treated as important data, per 2024 guidance.

CIIOs face stricter obligations: localized storage of PI and important data, annual security assessments, and mandatory CAC security assessment for any outbound transfer.

Foreign law enforcement or judicial requests for data stored in China require approval from Chinese authorities (PIPL Article 41); unsanctioned provision is prohibited.

China is not an adequacy jurisdiction under GDPR; EU-China transfers require SCCs or other GDPR Article 46 tools in addition to Chinese export mechanisms.

Personal Information Protection Law (PIPL) effective 1 November 2021; first comprehensive national law dedicated to personal information, alongside Cybersecurity Law (2017) and Data Security Law (2021).

PIPL Article 4 defines personal information as information related to an identified or identifiable natural person, excluding anonymized information; anonymization must be irreversible.

Sensitive personal information (Article 28) includes biometric data, religious belief, specific identity, medical health, financial accounts, location tracking, and PI of minors under 14.

Lawful bases under Article 13: consent, contract necessity, statutory duty, public health or emergency, public interest reporting, already-disclosed information within reasonable scope, and other laws.

Separate consent is required for sensitive PI, providing PI to other processors, public disclosure, cross-border transfer, and automated decision-making with significant impact.

Article 24 governs automated decision-making: transparent rules, fair outcomes, no unreasonable differential treatment, and opt-out or human-explanation rights for significant-impact decisions.

PIPL applies extraterritorially where processing outside China serves the purpose of providing products or services to individuals in China or analyzing/evaluating behavior of individuals in China.

The 2024 State Council Provisions on Promoting and Regulating Cross-Border Data Flows raised thresholds and created free-trade-zone negative lists, softening earlier transfer requirements.

GB/T 35273 (Personal Information Security Specification) is a voluntary national standard widely used as a de facto compliance benchmark by regulators and auditors.

PIPL penalties: corrective orders, warnings, confiscation of illegal gains, suspension or termination of service, and fines up to RMB 50 million or 5% of prior-year turnover for serious violations; responsible individuals up to RMB 1 million.

Enforcement is multi-regulator: the Cyberspace Administration of China (CAC) leads, with MIIT, Ministry of Public Security, SAMR, and PBOC acting within their sectors.

Article 66 serious-violation triggers include unlawful processing causing serious consequences such as large-scale infringement or major data breaches.

The CAC's 2021 and 2022 campaigns targeted illegal app collection of PI; app operators were ordered to rectify and non-compliant apps were removed from stores.

The 2021 Didi case resulted in a RMB 8.026 billion fine and a two-year suspension of new user registration, illustrating national-security-linked enforcement.

The 2022-2023 Ant Group and related fintech penalties (PBOC) show financial regulators enforcing PI and data rules alongside financial regulation.

Data breach notification: PIPL Article 57 requires immediate remedial action and notification to the authority and affected individuals; individual notification may be avoided if harm is effectively prevented.

CAC enforcement in 2023 and 2024 increasingly focuses on cross-border transfer compliance, sensitive PI processing, and children's data.

Administrative penalties are published by regulators and increasingly used as a compliance signal; individuals may also sue under PIPL Article 69 under a fault-based liability standard.

Build a PI inventory and classify data as general PI, sensitive PI, important data, or core data; classification drives consent, security, and transfer obligations.

Consent must be voluntary, explicit, informed, and separate from bundled terms; pre-ticked boxes and default consent are invalid.

Privacy notices must state the processor's identity, purpose, method, categories, retention period, and how individuals exercise rights.

Individual rights under PIPL include access, copy, correction, deletion, withdrawal of consent, data portability, and explanation of automated decisions.

Data Protection Impact Assessments (PIPL Article 55) are required for sensitive PI, automated decision-making, entrusting or providing PI to third parties, public disclosure, and cross-border transfers; records kept at least three years.

A Personal Information Protection Officer is required for processors exceeding the CAC volume threshold (currently 1 million individuals' PI) and must be reported to the regulator.

Data breach response should include containment, internal escalation, regulator notification, individual notification where harm is likely, and post-incident review.

Vendors are 'entrusted parties' under Article 21; contracts must specify purpose, duration, method, data categories, security measures, and prohibit sub-entrusting without consent.

Security measures should follow the Cybersecurity Law Multi-Level Protection Scheme (MLPS 2.0) and the GB/T 35273 standard for PI security controls.

Cross-border transfer mechanisms under PIPL Article 38: CAC security assessment, CAC-filed standard contract, certification by a professional body, or other conditions set by law.

Security assessment is mandatory for CIIOs, for important data, and for PI of more than 1 million individuals (thresholds adjusted by 2024 Provisions).

Standard contract filing requires the CAC template, a PI protection impact assessment, and filing with the provincial CAC within 10 working days of signing.

The 2024 Provisions allow exemptions for international trade, academic cooperation, and emergency situations, and permit free-trade zones to adopt negative lists.

Data export security assessment applications are filed with the provincial CAC and reviewed by the national CAC; approval is valid for a period (typically 2 years under the 2024 rules).

Important data is defined by sectoral catalogs and regulator designations; absent a designation, data is generally not treated as important data, per 2024 guidance.

CIIOs face stricter obligations: localized storage of PI and important data, annual security assessments, and mandatory CAC security assessment for any outbound transfer.

Foreign law enforcement or judicial requests for data stored in China require approval from Chinese authorities (PIPL Article 41); unsanctioned provision is prohibited.

China is not an adequacy jurisdiction under GDPR; EU-China transfers require SCCs or other GDPR Article 46 tools in addition to Chinese export mechanisms.