China’s PIPL Is the Extraterritorial Privacy Law Global Companies Cannot Ignore
China’s Personal Information Protection Law took effect on 1 November 2021. Its reach extends beyond China when overseas processing targets or analyses people inside the country.
The Personal Information Protection Law is China’s comprehensive framework for processing personal information. It regulates collection, use, sharing, automated decision-making, sensitive information, individual rights, security and international transfers.
It is often compared with the GDPR. The comparison can be useful, but treating PIPL as a translated GDPR checklist hides important differences in legal bases, consent, national rules and transfer mechanisms.
Overseas organisations can be in scope
PIPL applies to processing inside China. It can also apply to processing outside China when the purpose is to provide products or services to individuals in China, analyse their behaviour, or meet another condition provided by law.
Relevant overseas processors must establish a specialised agency or appoint a representative in China and submit the required information to the authorities.
This means a service does not avoid the framework because analytics, support or hosting occur elsewhere. Product language, customer targeting and behavioural analysis can matter more than the server address.
Separate consent appears repeatedly
PIPL requires a lawful basis for processing and places significant weight on informed consent. Separate consent is required in several situations, including providing information to another processor, processing sensitive personal information and certain cross-border transfers.
A single broad acceptance may therefore be insufficient. Consent records need to show which activity was authorised, when information was provided and how withdrawal propagates through systems.
Sensitive information needs a specific purpose
Sensitive personal information includes biometrics, religious beliefs, specific identity information, medical and health information, financial accounts, location information and personal information of children under fourteen.
Processing requires a specific purpose, necessity and strict protective measures. Separate consent is generally required, and additional information about necessity and impact must be provided.
Organisations should locate sensitive fields in telemetry, support tools and derived profiles—not only primary customer databases.
Automated decisions must be fair and explainable
Automated decision-making must be transparent, fair and impartial. Organisations may not impose unreasonable differential treatment in transaction prices or other conditions.
Where automated decisions are used for personalised information or marketing, individuals must receive a non-personalised option or a convenient refusal mechanism. For decisions with a significant effect, individuals have rights to request an explanation and to refuse decisions made solely through automation in the circumstances described by the law.
These rules reach recommendation, fraud, pricing and eligibility systems. A model inventory should therefore record decisions and effects, not merely model names.
Impact assessments and breach response
Processors must conduct and retain personal-information protection impact assessments for specified high-risk activities, including sensitive information, automated decisions, sharing, publication and cross-border transfers.
If information is breached, altered or lost—or may be—the processor must take remedial action and notify authorities and affected individuals as required.
A practical PIPL programme
Global organisations should:
- Identify services offered to people in China and behaviour analysed from abroad.
- Determine whether a Chinese representative or local agency is required.
- Map processing purposes, consent and separate-consent events.
- Locate sensitive information and children’s data.
- Review automated decisions for transparency and differential treatment.
- Assess approved mechanisms for international transfers.
- Maintain impact assessments and processing records.
- Build local regulatory and individual-notification steps into incident response.
One global privacy banner is not a programme
PIPL shares themes with other privacy laws, but compliance depends on Chinese legal requirements, infrastructure and enforcement. A global baseline can reduce duplication; it cannot erase local differences.
The safest approach is a common data inventory and control framework with explicit jurisdictional rules—not a promise that whichever privacy policy was written first governs the world.
Official sources
- Official English text of the Personal Information Protection Law
- National Laws and Regulations Database entry
This article provides general information and is not legal advice.
Continue the series: APAC Cyber & Digital Law Series index
