China Data Protection Law and Policy
Statutory architecture
China’s data regime is layered, not a single code. The Cybersecurity Law (CSL, 2017) establishes network operator duties, MLPS grading, and critical information infrastructure (CII) protection. The Data Security Law (DSL, 2021) adds data classification, important data, and security assessment. The Personal Information Protection Law (PIPL, 2021) is the comprehensive PI statute. Implementing measures-CAC’s cross-border security assessment measures, standard contract measures, certification rules-and national standards such as GB/T 35273 operationalize it; standards are not statutes but shape enforcement expectations.
Core PIPL rules
- PI is information relating to an identified or identifiable natural person. Sensitive PI is a closed statutory list: biometric characteristics, religious belief, specific identity, medical health, financial accounts, whereabouts, and PI of minors under 14.
- Article 13 legal bases: consent; contract necessity; legal duty; public health/emergency; news/public opinion supervision within reasonable scope; publicly disclosed PI within reasonable scope; other laws. There is no general “legitimate interest” basis.
- Principles: lawfulness, propriety, necessity, good faith; minimum scope; transparency; accuracy; security; accountability.
- Separate consent is required for sensitive PI, providing PI to another processor, public disclosure, and cross-border transfer. Consent must be informed, voluntary, and withdrawable as easily as given.
- Individual rights include know/decide, restrict or refuse processing, access/copy, portability, correction, deletion, explanation, and complaint. Large-scale processors must designate a PI protection officer; overseas processors must appoint a local representative.
Worked example
A fitness app collects heart-rate and precise location data and wants to share it with an insurer. Heart rate and location are sensitive PI. The app needs a specific purpose, necessity assessment, separate consent, and a PIPIA. A blanket privacy-policy acceptance is insufficient. The insurer is a separate recipient, so the app must disclose the recipient’s identity, purpose, and method and obtain separate consent. If data goes abroad, Article 38 transfer mechanism and Article 39 cross-border consent are also needed.
Traps
- Treating consent as the only basis; PIPL permits other bases.
- Assuming “legitimate interest” works as in GDPR.
- Missing that sensitive PI is a statutory list, not a risk judgment.
- Using one checkbox for all purposes.
- Confusing deletion with anonymization.