China

Regulator And AuthorityGreen

CAC is the lead/coordinating supervisory authority; MIIT, MPS, SAMR and financial regulators exercise delegated enforcement in their respective domains, unlike the single-authority models of GDPR/CPRA.

Claims (1):

• The PIPL confers enforcement authority jointly on multiple governmental departments — CAC, MIIT, the Ministry of Public Security, SAMR and financial regulators, plus local counterparts — with CAC taking a leading and coordinating role rather than acting as a single unified supervisory authority as under GDPR or CPRA.

Act And InstrumentsGreen

The CSL/DSL/PIPL triad forms the statutory core, implemented via the Network Data Security Management Regulations (eff. 1 Jan 2025) and numerous CAC secondary rules.

Claims (1):

• China's data governance framework rests on three national laws (CSL 2017/amended 2025, DSL 2021, PIPL 2021), implemented at national level via the Regulations on Network Data Security Management, effective 1 January 2025.

Material ScopeGreen

PIPL governs personal information handling activities undertaken by personal information handlers and entrusted parties (the processor-equivalent concept).

Claims (1):

• PIPL is China's first comprehensive data protection legislation and regulates personal information handling activities by personal information handlers and entrusted parties.

Territorial ScopeGreen

Article 3 gives PIPL extraterritorial reach, analogous to GDPR Art 3(2), covering overseas handling aimed at providing products/services to, or analyzing/assessing the behavior of, individuals in China.

Claims (1):

• PIPL Article 3 extends its territorial scope to the handling of personal information conducted outside China where the purpose is to provide products or services to, or to analyze/assess the behavior of, individuals located in China, or other purposes specified by law.

Regulator Registration And FilingAmber

Offshore handlers caught by Article 3 must establish a dedicated office or appoint a representative in China and report identifying details to the competent authority (Art 53).

Claims (1):

• Offshore personal information handlers subject to PIPL under its extraterritorial provisions must establish a dedicated office or appoint a designated representative in China for personal information protection purposes (Art 53).

Lawful BasesGreen

Article 13 lists non-consent lawful bases (contract performance/HR management, statutory duties, public-health emergencies, news reporting in the public interest, lawfully disclosed information); PIPL does not recognize a GDPR-style 'legitimate interests' basis.

Claims (1):

• PIPL Article 13 permits processing without consent where necessary for contract performance or HR management under lawfully formulated labor policies, to perform legal responsibilities, to respond to public health emergencies, for public-interest news reporting, or for lawfully disclosed information; PIPL does not recognize 'legitimate interests' as a lawful basis, unlike GDPR.

Consent ThresholdsAmber

Consent must be informed, freely given, evidenced by clear action and revocable (Arts 14–15); 'separate consent' (a higher, purpose-specific standard) is required for sharing, public disclosure, sensitive-data processing and cross-border transfer (Arts 23, 25, 29, 39).

Claims (1):

• Consent under PIPL must be informed, freely given and evidenced by a clear affirmative action, with a standing right of withdrawal (Arts 14–15); a heightened 'separate consent' is additionally required when handlers share PI with other handlers, publicly disclose PI, process sensitive PI, or transfer PI abroad (Arts 23, 25, 29, 39).

Special CategoriesGreen

Article 28 defines sensitive personal information broadly — biometric identification, religious beliefs, specially-designated status, medical/health data, financial accounts, location/whereabouts data, and personal information of minors under 14 — a wider sweep than GDPR Art 9.

Claims (1):

• PIPL Article 28 defines sensitive personal information to include biometric identification information, religious beliefs, specially-designated status, medical health information, financial accounts, information on individuals' whereabouts, and personal information of minors under the age of 14.

Pseudonymisation And AnonymisationGreen

Anonymized information (rendered permanently non-identifiable and non-restorable) falls outside PIPL's scope of 'personal information' (Arts 4 & 73); PIPL uses 'de-identification' as its pseudonymisation-equivalent concept.

Claims (1):

• Anonymized information is not deemed personal information under PIPL; anonymization is defined (Arts 4 & 73) as processing that renders data non-identifying and non-restorable to a specific natural person, while 'de-identification' functions as PIPL's pseudonymisation-equivalent concept.

Access RightGreen

Individuals have the right to access and obtain copies of their personal information, which handlers must provide in a timely fashion.

Claims (1):

• Under PIPL, individuals have the right to access and make copies of their personal information, and personal information handlers must provide such information in a timely fashion.

Rectification And ErasureGreen

Individuals may request correction, supplementation or updating of inaccurate/incomplete/outdated personal information, and may request deletion.

Claims (1):

• Individuals are entitled to correct, supplement and update incomplete, inaccurate or outdated personal information and may request deletion of their personal information from handlers.

Restriction And ObjectionGreen

Individuals may demand an explanation of automated-decision-making use and may refute decisions made solely via automated means where those decisions significantly affect them.

Claims (1):

• Data subjects have the right to request an explanation regarding the use of their personal information and to refute a decision made by a handler solely through automated decision-making where it significantly affects them.

Data PortabilityGreen

PIPL provides a portability right allowing individuals to request transfer of their personal information to another handler; PIPL goes further than GDPR by permitting legal claims against handlers who reject rights requests.

Claims (1):

• PIPL provides a right of portability whereby individuals may request that a personal information handler transfer their personal information to another handler; PIPL exceeds GDPR by granting individuals a right to bring claims against handlers who reject a rights request and a right to demand an explanation of handling rules.

Deadlines And Response WindowsAmber

PIPL requires handlers to respond to access requests 'in a timely fashion' but does not set a fixed statutory day-count deadline analogous to GDPR's one-month rule; no secondary source located specifying a harmonized numeric window across all right types.

Claims (1):

• PIPL requires personal information handlers to respond to access requests 'in a timely fashion' rather than specifying a codified numeric response deadline equivalent to GDPR's one-month rule.

Accountability And DpiaAmber

PIPL lacks an express GDPR-style accountability principle but requires handlers to accept responsibility for their processing and adopt necessary safeguards; DPIAs (Art 55) are mandatory for sensitive-data processing, ADM, entrusting/sharing/disclosing PI, cross-border transfer, and other major-impact processing.

Claims (1):

• Under PIPL Article 55, a personal information handler must conduct a personal information protection impact assessment prior to handling sensitive personal information, using personal information for automated decision-making, entrusting/sharing/disclosing personal information, transferring personal information abroad, or engaging in other processing with a major influence on individuals; the assessment must evaluate lawfulness/necessity, impact on individuals' rights, and adequacy of protective measures.

Dpo RequirementsAmber

PIPL requires appointment of a Personal Information Protection Officer (PIPO) above an as-yet-undefined processing-volume threshold; industry guidance points to organizations processing hundreds of thousands to millions of individuals' data.

Claims (1):

• PIPL requires certain handlers to appoint a Personal Information Protection Officer (PIPO), but the precise processing-volume threshold triggering this requirement is not specified in the statute; analogous CAC draft measures reference thresholds around one million individuals' data.

Ropa RequirementsAmber

Unlike GDPR's blanket Art 30 requirement, PIPL imposes record-keeping only for the DPIA-triggering categories, with processing records and assessment reports retained for at least three years (Art 55).

Claims (1):

• Unlike GDPR's universal Article 30 record-keeping duty applicable to controllers and processors alike, PIPL imposes record-of-processing obligations on handlers only for the categories triggering a DPIA, and requires retention of impact-assessment processing records for at least three years (Art 55).

Joint Controller ArrangementsAmber

PIPL does not define 'entrusted parties' as precisely as GDPR defines processors, but imposes obligations on them, including a duty to notify and assist the handler in the event of a breach affecting entrusted data.

Claims (1):

• PIPL does not define 'entrusted parties' (the processor-equivalent role) as precisely as GDPR defines data processors, though it imposes obligations on such parties, including a duty to notify the handler and provide technical/administrative assistance in the event of a breach involving entrusted personal information.

Security MeasuresGreen

Handlers must adopt organizational and technical measures — internal management rules, PI classification, encryption/de-identification, access controls, periodic staff training, and incident-response mechanisms.

Claims (1):

• PIPL requires handlers to adopt organizational and technical measures to prevent unauthorized access, damage, leakage or loss of personal information, including internal management mechanisms, classification of personal information, encryption and de-identification, access controls, and periodic security training.

Breach NotificationGreen

Article 57 requires handlers, on any actual or possible leak, distortion or loss of PI, to take remedial measures and notify regulators and affected individuals of incident categories, causes, possible harm, remedial steps and contact details, unless harm is effectively avoided.

Claims (1):

• Under PIPL Article 57, whenever a leak, distortion or loss of personal information occurs or might have occurred, handlers must adopt remedial measures and notify relevant departments and affected individuals of the information categories, causes and possible harm, the remedial measures taken and steps individuals can take to mitigate harm, and a method of contact; notification to individuals is excused where the handler adopts measures effectively avoiding harm.

Retention And DisposalGreen

The 2025 Network Data Security Management Regulations require companies processing personal data of more than 10 million individuals to submit a data disposal plan to regulators in the event of a merger, acquisition, spin-off or insolvency affecting data security.

Claims (1):

• The Regulations on Network Data Security Management require a company processing personal data of more than 10 million individuals to establish a dedicated department and appoint a senior data-security executive, and to submit a data disposal plan to regulators upon a merger, acquisition, spin-off or insolvency affecting data security.

Transfer MechanismsAmber

Article 38 provides three transfer mechanisms: CAC-led security assessment (for CIIOs/large-volume processors), CAC-authorized certification, and the Chinese standard contract.

Claims (1):

• PIPL Article 38 offers three cross-border data transfer mechanisms depending on the characteristics of the exporting entity: a CAC-led security assessment (mandatory for CIIOs and large-volume processors), a PI-protection certification issued by CAC-authorized professional institutions, or a standard-contract agreement with the overseas recipient based on CAC-issued clauses.

Adequacy ReceivedRed

PIPL does not provide a mechanism for cross-border transfers premised on adequacy decisions from other jurisdictions, in contrast with GDPR Art 45.

Claims (1):

• Unlike GDPR, PIPL does not provide for cross-border transfers of personal information premised on a finding of 'adequate protection' in the recipient jurisdiction; all outbound transfers must instead satisfy one of PIPL's three domestic transfer mechanisms.

Adequacy GrantedRed

No evidence was found of China issuing formal 'adequacy' determinations toward other jurisdictions; its transfer regime is structured around security assessment, SCC and certification rather than a unilateral-adequacy concept.

Sccs And BcrsAmber

The Chinese SCCs (effective 1 June 2023) require Chinese law as the governing law, use a single universal contract template regardless of controller/processor role, and must be filed with the provincial CAC within 10 working days of effectiveness together with the impact assessment report.

Claims (1):

• The Chinese Standard Contractual Clauses, effective 1 June 2023, require the cross-border data transfer agreement to be governed by Chinese law, use a single universal template regardless of the parties' controller/processor role, and be filed with the provincial CAC together with the impact assessment report within 10 working days of effectiveness.

Transfer Impact AssessmentAmber

SCC-based (and security-assessment-based) transfers require an accompanying impact assessment report; the assessment must be redone and re-filed with the provincial CAC upon material changes such as extended retention, altered purpose/scope/volume/sensitivity, or changes in the destination country's data protection laws.

Claims (1):

• Parties to an SCC-based cross-border transfer must redo the impact assessment, update the transfer agreement, and re-file with the provincial CAC where circumstances materially change, including extension of retention period, changes in processing purpose/scope/category/volume/storage location/sensitivity, or changes in the destination country's data protection laws affecting data subjects.

Data LocalisationAmber

CIIOs and processors handling large volumes of personal information must store personal information locally in China, with overseas transfer conditioned on passing a CAC security assessment (Art 40); the March 2024 CBDT relaxations raised numeric thresholds and exempted several transfer scenarios (e.g., employee data) from any CBDT mechanism.

Claims (1):

• CIIOs and entities processing large volumes of personal information must store citizens' personal information and important data locally in China, with overseas transfer conditioned on passing a CAC-led security assessment; the March 2024 CBDT Provisions relaxed thresholds so that non-CIIO handlers transferring between 100,000 and 1,000,000 individuals' data (or under 10,000 individuals' sensitive data) may use SCC/certification rather than a full security assessment, and exempted employee-data transfers from any CBDT mechanism regardless of volume where employment-law conditions are met.

Financial Sector OverlayAmber

PBOC's Financial Data Security — Data Security Classification Guidelines (2020) impose sector-specific classification duties, and the amended Anti-Money Laundering Law (effective 1 Jan 2025) requires financial institutions to protect KYC/AML data confidentiality consistent with CSL/DSL/PIPL and to report before cross-border KYC/transaction-record disclosures to foreign authorities.

Claims (1):

• The People's Bank of China issued the Financial Data Security — Data Security Classification Guidelines establishing sector-specific data classification obligations for financial institutions, and the amended Anti-Money Laundering Law (effective 1 Jan 2025) requires financial institutions to protect the confidentiality of collected KYC/AML information consistent with CSL/DSL/PIPL and to report to the competent Chinese financial regulator before disclosing customers' KYC information or transactional records to foreign authorities.

Health Sector OverlayRed

No dedicated health-sector data protection statute distinct from PIPL's general treatment of 'medical health information' as sensitive personal information was identified.

Telecoms And EprivacyAmber

China lacks a discrete ePrivacy-style instrument; illustrative enforcement includes MIIT's 2021 sweep ordering WeChat, Tencent and other apps to rectify illegal transfer of contact-list and location data and pop-up harassment practices.

Claims (1):

• MIIT found that a batch of applications, including WeChat and other Tencent products, illegally transferred users' contact-list and location data and used pop-up harassment, ordering their parent companies to make rectifications.

Employment DataGreen

Under the CBDT relaxations, employee-data transfers are exempt from all CBDT legal mechanisms irrespective of volume, provided underlying Chinese employment-law conditions (e.g., democratically consulted employee handbooks) are met.

Claims (1):

• Under the CBDT regulations, employee data transfers are exempt from any of the CBDT legal mechanisms irrespective of data volume, provided companies meet relevant Chinese employment-law conditions extending beyond data protection rules (e.g., a democratically consulted employee handbook).

Credit And ScoringAmber

PIPL Article 67 allows violations to be recorded into a handler's 'credit files' under China's national social credit system, layering credit-scoring consequences onto ordinary administrative penalties.

Claims (1):

• PIPL Article 67 provides that violations may be recorded into the 'credit files' of the processing entity under China's national social credit system, in addition to monetary penalties.

EducationRed

No education-sector-specific data protection overlay was identified in this research pass.

InsuranceAmber

Insurance-sector data processing falls within the general financial-regulator enforcement lane under PIPL Arts 60/63; no insurance-specific data rule distinct from the general financial-sector overlay was located.

Claims (1):

• PIPL Article 60 designates financial regulators (which encompass insurance-sector oversight) among the sectoral supervisory authorities empowered to enforce PIPL within their respective designated areas.

Cookies And TrackersRed

No standalone ePrivacy-equivalent cookie/tracker consent statute was identified for China; tracking technologies are governed generally through PIPL's consent framework rather than a dedicated cookie law.

Dark PatternsAmber

Joint CAC/MIIT/MPS/SAMR enforcement campaigns have targeted apps for harassing pop-up windows and illegal collection of contact-list/location data, functioning as de facto anti-dark-pattern enforcement absent a codified prohibition.

Claims (1):

• MIIT, CAC, MPS and SAMR jointly conducted enforcement campaigns (2020–2021) against apps engaging in illegal collection and use of personal information and harassing pop-up notifications, functioning as enforcement against dark-pattern-style practices absent a codified statutory prohibition.

Opt Out SignalsRed

No Global Privacy Control or DAA-equivalent standardized opt-out signal mechanism was identified in China's regulatory framework.

Clean Rooms And DcrRed

No data-clean-room or data-collaboration-room-specific regulatory regime was identified for China in this research pass.

Cross Context AdvertisingAmber

The 2022 Provisions on the Management of Algorithmic Recommendations regulate algorithms used for content recommendation and targeted advertising, requiring transparency and fairness and prohibiting practices that disrupt public order.

Claims (1):

• The Provisions on the Management of Algorithmic Recommendations in Internet Information Services (effective 1 March 2022) regulate algorithms used for content recommendation, requiring transparency and fairness and prohibiting practices that disrupt public order, including personalized price discrimination.

Direct MarketingGreen

PIPL Article 24 requires that where handlers use automated decision-making for business marketing or push notifications, they must simultaneously offer options not targeting an individual's personal characteristics, or provide a simple means of rejection.

Claims (1):

• PIPL requires that personal information processors conducting business marketing to individuals through automated decision-making simultaneously provide options that do not target an individual's personal characteristics, or offer ways for individuals to reject such marketing.

Profiling RestrictionsAmber

PIPL Article 24 prohibits unreasonable differential treatment via automated decision-making (e.g., algorithmic price discrimination) and requires non-targeted or opt-out marketing options.

Claims (1):

• PIPL Article 24 requires personal information processors engaging in automated-decision-making-based marketing to provide non-targeted options or simple rejection mechanisms, addressing algorithmic price discrimination and profiling-driven differential treatment.

Automated Decision Making TransparencyGreen

Individuals may request an explanation of automated-decision-making use and challenge decisions made solely by automated means where those decisions significantly affect them.

Claims (1):

• Data subjects have the right to request an explanation regarding the use of personal information in automated decision-making and to refute a decision made solely by automated means where it significantly affects them.

Ai Risk AssessmentsAmber

The amended Cybersecurity Law (passed October 2025) brings AI governance within CSL's scope and raises maximum penalties; the 2023 Interim Measures for Generative AI Services separately require security assessments for generative AI services with 'public opinion attributes.'

Claims (1):

• China's amended Cybersecurity Law, passed in October 2025, brings artificial intelligence governance within the CSL's scope and raises the maximum fine for companies to CNY50 million or 5% of the previous year's turnover, with individual penalties up to CNY1 million.

Biometric RegimeAmber

Biometric identification information is classified as sensitive personal information under PIPL Art 28, requiring separate consent, and is further governed by CAC measures on the security of facial recognition technology.

Claims (1):

• PIPL Article 28 classifies biometric identification information as sensitive personal information requiring separate consent for processing, and CAC has issued dedicated measures governing the security of facial recognition technology deployment.

Genetic DataRed

No standalone genetic-data regime distinct from PIPL's general 'medical health information' sensitive-category treatment was identified in this research pass.

State Surveillance CarveoutsRed

PIPL's consumer-facing protections do not constrain the PRC central government's own data access; independent legal commentary observed little indication of legal limits on state surveillance activity notwithstanding PIPL's commercial-sector rules.

Claims (1):

• PIPL's private-sector-facing protections do not prevent the PRC central government from accessing data, and legal commentators have observed little indication of legal limits on government surveillance or meaningful civil-society oversight mechanisms in this area.

Age VerificationAmber

The operative age threshold for heightened protection is 14 years; the December 2025 CAC directive requires filings on the nature, categories and volume of minors' personal information collected, implying an age-identification/verification compliance step, though no standalone age-verification technical mandate was located.

Claims (1):

• PIPL classifies the personal information of minors under the age of 14 as sensitive personal information, and CAC's 2019 Provisions on Cyber Protection of Children's Personal Information (China's COPPA-equivalent) requires parental/guardian consent for handling children's data; a CAC directive issued 28 December 2025 further requires companies collecting minors' personal information to complete compliance audits and file supporting materials with local CAC offices by 31 January 2026.

Parental ConsentGreen

PIPL treats personal information of minors under 14 as sensitive personal information, requiring parental or guardian consent for processing, building on the 2019 Provisions on Cyber Protection of Children's Personal Information.

Claims (1):

• PIPL classifies the personal information of minors under the age of 14 as sensitive personal information, and CAC's 2019 Provisions on Cyber Protection of Children's Personal Information (China's COPPA-equivalent) requires parental/guardian consent for handling children's data; a CAC directive issued 28 December 2025 further requires companies collecting minors' personal information to complete compliance audits and file supporting materials with local CAC offices by 31 January 2026.

Minor Profiling BansRed

No standalone algorithmic-profiling ban specific to minors, distinct from PIPL's general ADM transparency/opt-out rules, was identified in this research pass.

Education SettingsRed

No education-setting-specific children's data protection rule was identified in this research pass.

Dependent AdultsRed

PIPL allows close relatives to exercise a deceased individual's data protection rights, but no dedicated regime for living dependent adults (elderly or mentally incapacitated persons) was identified.

Claims (1):

• PIPL permits close relatives of a deceased individual to exercise that individual's data protection rights, but no equivalent statutory protection specific to living dependent adults (e.g., elderly or mentally incapacitated persons) was identified.

Regulator Powers And PenaltiesGreen

Article 63 grants broad investigatory powers; a two-tier (general/grave) administrative penalty structure applies, with grave violations reaching RMB50 million or 5% of prior-year turnover plus business-suspension/license-revocation powers.

Claims (1):

• PIPL Article 63 grants supervisory authorities investigatory powers including interviews, document review, on-site inspections, and equipment seizure/confiscation; the law creates a two-tier penalty structure with general violations fined up to RMB1 million for handlers and RMB100,000 for responsible officers, and grave violations fined up to RMB50 million or 5% of the previous year's annual revenue for handlers and RMB100,000–1 million for officers, alongside rectification orders, business suspension, and license revocation powers.

Enforcement Activity IndexGreen

Landmark fines include RMB8.026 billion against Didi Global (2022) for CSL/DSL/PIPL violations and RMB50 million against academic database provider CNKI (2023) for PIPL/CSL violations.

Claims (1):

• CAC fined Didi Global approximately RMB8.026 billion in 2022 for violations of the CSL, DSL and PIPL, and separately fined academic database provider CNKI RMB50 million for PIPL and CSL violations in 2023, illustrating sustained large-scale enforcement activity.

Regulator Funding And CapacityRed

No specific data on CAC budget or headcount was located in this research pass.

Collective Redress And Class ActionsGreen

Article 70 grants standing for public-interest actions (China's equivalent of class actions) to the People's Procuratorate, statutorily designated consumer organizations, and CAC-designated organizations.

Claims (1):

• PIPL Article 70 grants standing to file public-interest actions — China's functional equivalent of class actions — to the People's Procuratorate, statutorily designated consumer organizations, and organizations designated by CAC, where a handler's infringement affects a large number of individuals.

Private Right Of ActionGreen

PIPL Article 69 shifts the burden of proof to the defendant handler once an individual demonstrates an infringement, and courts may calculate damages by reference to the handler's gains rather than only the individual's actual losses.

Claims (1):

• PIPL Article 69 shifts the burden of proof to the defendant handler once a data subject demonstrates an infringement of their personal-information rights, and courts assessing damages are not limited to actual losses but may instead rely on the gains the handler obtained from the infringing conduct.

Recent Developments 180DAmber

Within the last 180 days: the amended Cybersecurity Law (passed October 2025) raised maximum penalties and folded AI governance into CSL; a CAC directive of 28 December 2025 mandated minors'-data compliance audits and filings by 31 January 2026; and TC260 released draft amendments to the (non-binding) GB/T 35273 national standard on 17 June 2026, introducing new AI-governance and legal-basis chapters, with public comment open until 16 August 2026.

Claims (1):

• Within the 180 days preceding this run: China's amended Cybersecurity Law (passed October 2025) raised the maximum corporate fine to CNY50 million or 5% of prior-year turnover and folded AI governance into CSL's scope; a CAC directive dated 28 December 2025 required companies collecting minors' personal information to complete compliance audits and submit filings to local CAC offices by 31 January 2026; and on 17 June 2026 TC260 released draft amendments to the non-binding GB/T 35273 national standard, adding a new chapter on legal-basis guidance and AI-driven governance updates, with public comment open until 16 August 2026.