CHINAGATEWAY.PRO
Contact

Article

PIPL Compliance for Foreign Companies: What China's Data Law Requires Beyond the Filing

October 6, 2026

You have met the Personal Information Protection Law — PIPL, China's privacy and data-protection statute — in a compliance review or a vendor questionnaire. Definitions and scope live in our PIPL glossary entry; this page is the operational layer — what a foreign company actually puts in place when mainland users touch its product, and which articles require each step.

Need hands-on help? Our ICP and compliance service covers PIPL alongside hosting and filing.

TL;DR

  • Scope. PIPL reaches offshore processing when the purpose is offering products or services to mainland persons or analyzing their behavior (Art. 3); hosting location alone does not decide. A third limb covers other situations prescribed by laws and administrative regulations.
  • Lawful bases, notice, consent. Every processing activity needs a lawful basis — consent is one of seven (Art. 13), voluntary, explicit, and fully informed (Art. 14), with a convenient withdrawal mechanism (Art. 15); a four-item notice must precede processing (Art. 17).
  • Offshore duty, assessments, penalties. Offshore handlers must establish a mainland entity or designate a representative (Art. 53); five activities — including cross-border provision — require a pre-impact assessment kept at least three years (Arts. 55–56); the statutory ladder runs to RMB 50 million or 5% of prior-year turnover (Art. 66).
Glowing data nodes stream through a luminous cyan lattice arch gate on a dark reflective floor, representing a data-protection boundary.
The PIPL data-protection boundary for China-facing products

Who PIPL Reaches

Inside the PRC, PIPL covers the processing of natural persons’ personal information. Outside the PRC, two purpose-based situations trigger it: offering products or services to mainland natural persons, or analyzing or assessing their behavior. A third limb covers other situations that laws and administrative regulations may prescribe. Hosting location does not decide applicability — purpose does. PIPL is a separate statute from the ICP filing pipeline; no infrastructure choice satisfies it.

The Seven Lawful Bases (Art. 13)

Every processing activity needs a lawful basis. Article 13 lists seven:

  1. Individual consent.
  2. Necessity for concluding or performing a contract where the individual is a party, or HR management under lawfully adopted labor rules and collective contracts.
  3. Necessity for performing statutory duties or obligations.
  4. Public-health emergencies or protecting life, health, or property in emergencies.
  5. Public-interest news reporting and opinion supervision within a reasonable scope.
  6. Processing personal information the individual self-disclosed or that was otherwise lawfully disclosed, within a reasonable scope.
  7. Other situations provided by laws or regulations.

Where other provisions require consent, items (2)–(7) lift that requirement. The practical work is mapping each activity to the basis that fits.

Consent Has Rules of Its Own (Arts. 14–16)

When consent is the chosen basis, it must be voluntary, explicit, and given in a fully informed state (Art. 14). Where the law requires separate or written consent — for sensitive personal information (Art. 29) or minors under 14 (Art. 31) — those rules apply. Changes to purpose, method, or personal-information types require fresh consent (Art. 14).

The individual may withdraw consent at any time, and the handler must provide a convenient withdrawal mechanism (Art. 15). A handler may not refuse products or services because an individual refuses or withdraws consent, unless processing is necessary to provide them (Art. 16).

The Notice Is a Defined Artifact (Art. 17 + Art. 30)

Before processing begins, the handler must prominently, clearly, and intelligibly inform the individual of four items:

  1. The handler’s name and contact details.
  2. Purpose, method, personal-information types, and retention period.
  3. How to exercise rights, and the procedures for doing so.
  4. Other items laws or regulations require.

Published processing rules must be public, convenient to consult, and easy to save, with changes communicated. Processing sensitive personal information adds a notice of its necessity and its impact on the individual’s rights and interests (Art. 30).

Processing from Offshore: The Mainland Representative (Art. 53)

An offshore handler caught by the Art. 3 purpose tests must establish a dedicated entity inside the PRC or designate a representative responsible for personal-information-protection affairs, and report the entity’s name — or the representative’s name and contact details — to the department performing PIPL duties. The law states this duty but no procedure for the report.

Assess Before You Process: The Five PIPIA Triggers (Arts. 55–56)

A personal-information protection impact assessment must run before processing begins whenever one of five triggers fires:

  1. Processing sensitive personal information.
  2. Using personal information for automated decision-making.
  3. Entrusting processing, providing it to other handlers, or making it public.
  4. Providing personal information across the border (see cross-border data transfer for mechanics and thresholds).
  5. Other processing with a major impact on individuals’ rights.

Art. 24 adds three automated-decision duties: transparency and fair, impartial results; no unreasonable differential treatment on price or other terms; and a non-profiled option or convenient refusal route for automated push marketing. The assessment covers the lawfulness, legitimacy, and necessity of the purpose and method; the impact on individual rights and security risks; and whether protection measures are lawful, effective, and proportionate. Keep the report and records at least three years.

What Violations Cost (Art. 66)

The statutory penalty ladder has two tiers. At the base level, the regulator issues a correction order, a warning, and confiscation of illegal gains, and may order the violating app’s service suspended or terminated. Refusal to correct brings fines of up to RMB 1,000,000, plus RMB 10,000–100,000 for directly responsible managers and other directly liable persons.

For serious cases — provincial-level or above authorities — the ceiling rises to RMB 50,000,000 or up to 5% of the prior year’s turnover, with possible business suspension or rectification, license and permit revocation, personal fines of RMB 100,000–1,000,000, and bans from director or senior-management posts for a set period.

A Compliance Sequence for a China-Facing Launch

A practical order of operations:

  1. Applicability (Art. 3). Confirm the purpose tests reach your processing; hosting location does not answer this.
  2. Lawful basis (Art. 13). Map each activity to one of the seven bases.
  3. Notice and consent (Arts. 14–17, 30). Draft the Art. 17 notice; wire separate-consent flags for sensitive PI and minors.
  4. Transfer basis (Art. 38). Choose the mechanism and file before the integration goes live; data-residency duties for CIIOs and large-volume handlers sit alongside (see data residency).
  5. PIPIA (Arts. 55–56). Run it before the activity starts; keep the report at least three years.
  6. Offshore (Art. 53). Arrange the entity or representative; report to the duty department.

This sequence runs beside the ICP filing pipeline — a separate process, typically two to four weeks for the filing itself.

Next steps

PIPL compliance sits alongside — not inside — your ICP filing and hosting setup. Launching or scaling a China-facing product? We can put the procedural layer in place.

Frequently asked questions

Do we need consent for everything under PIPL?

No. Consent is one of seven lawful bases (Art. 13); items (2)–(7) — contract necessity, statutory duties, emergencies, public-interest journalism, lawfully public data, other legal situations — lift the consent requirement where consent would otherwise be needed.

What must a China-facing privacy notice contain?

Article 17 requires four items: handler identity and contact; purpose, method, personal-information types, and retention period; how to exercise rights and the procedures; and other statutory items — prominent, clear, truthful, and complete. Processing sensitive personal information adds a necessity-and-impact notice under Art. 30.

We process mainland users’ data from our overseas HQ — does PIPL reach us?

If the purpose is offering products or services to mainland persons or analyzing their behavior, yes — Art. 3 applies wherever processing happens. Art. 53 then requires a mainland dedicated entity or a designated representative, plus a report to the duty department; the law states the duty but not the registration procedure.

What is a PIPIA and when do we need one?

A personal-information protection impact assessment is a pre-activity review required for five triggers: sensitive PI processing, automated decision-making, entrusted processing or provision to other handlers, cross-border provision, and other major-impact processing. Keep the report and records at least three years.

What are the penalties for PIPL violations?

Base level: correction order, warning, confiscation of illegal gains, possible app-service suspension; refusal to correct brings fines up to RMB 1,000,000 and RMB 10,000–100,000 per responsible person. Serious cases (provincial-level authority): up to RMB 50,000,000 or 5% of prior-year turnover, plus business suspension, license revocation, RMB 100,000–1,000,000 per responsible person, and management-post bans.

Does PIPL apply if our site is not hosted in China?

Hosting location does not decide applicability. The Art. 3 purpose tests do: if you offer products or services to mainland persons or analyze their behavior, PIPL reaches the processing — wherever the servers sit.

What special rules apply to sensitive data?

Sensitive personal information covers six categories — biometric, religious belief, specific identity, medical health, financial accounts, whereabouts — plus minors under 14. Processing requires separate consent (Art. 29), dedicated processing rules for minors (Art. 31), and an additional necessity-and-impact notice (Art. 30).

Is PIPL part of the ICP filing?

No. PIPL is a separate statute administered by a different authority. The ICP filing pipeline contains no PIPL step. The two are independent obligations.

What rules apply to automated decision-making?

Article 24 sets three duties: transparency and fair, impartial results, with no unreasonable differential treatment on transaction price or other terms; a non-profiled option or convenient refusal route for automated push marketing; and, where a solely automated decision has major impact on the individual’s rights, the right to demand an explanation and refuse it.

What rights do individuals have under PIPL?

Chapter 4 (Arts. 44–50) grants the right to know about and decide on processing, and to limit or refuse it (Art. 44); access and copy, plus portability under CAC-set conditions (Art. 45); correction and supplement (Art. 46); deletion in five defined situations, with a storage-and-security-only carve-out (Art. 47); an explanation of processing rules (Art. 48); near-relatives’ limited exercise for deceased persons (Art. 49); and a convenient rights-request mechanism with reasoned refusals and a court path (Art. 50).

Is there a PIPL compliance checklist we can work through?

Yes — treat this guide as the checklist. The sequence: confirm the Art. 3 purpose tests reach you; pick your Art. 13 lawful basis; publish the four-item Art. 17 notice; obtain separate consent where Arts. 14–16, 29, and 31 require it; appoint the Art. 53 mainland entity or representative; run a PIPIA before any of the five trigger activities and keep it at least three years (Arts. 55–56); meet the Art. 24 automated-decision duties; honor Chapter 4 rights — with the Art. 66 penalty ladder as the cost of missing a step.

How does PIPL compare with US privacy law?

PIPL is a single national statute applying economy-wide: the Art. 3 purpose tests reach offshore handlers serving mainland users, Art. 13 fixes seven lawful bases, and Art. 53 imposes the mainland representative duty. The US has no single federal equivalent — enforcement flows through the Federal Trade Commission under Section 5 of the FTC Act’s prohibition on unfair and deceptive acts. State statutes fill the gaps: the CCPA applies to for-profit businesses that do business in California meeting thresholds such as gross annual revenue of over $25 million or buying, selling, or sharing the personal information of 100,000 or more California residents or households (the CPRA amends the CCPA; it does not create a separate, new law). Where PIPL imposes statutory duties — the representative, the PIPIA — US federal practice leans on voluntary frameworks: the NIST Privacy Framework is a voluntary tool intended to help organizations identify and manage privacy risk. Build your China program around PIPL’s statutory duties, not US-practice assumptions.

Related articles

ICP Filing for Foreign Companies: Step-by-Step Timeline

From permit choice to a displayed ICP number: the five phases.

WFOE vs Hong Kong Company: ICP Filing Entity Rules Explained

Which entity can hold the filing — and which cannot.

Reach China Without an ICP Filing? Paths & Trade-offs

Where the ICP obligation actually attaches, and what serving China from offshore costs.

Getting PIPL-compliant is not a filing checkbox — it is an ongoing operational discipline.

Our ICP and compliance service covers the full stack: hosting, filing, and data-law alignment. Prefer a self-paced start? Run the 10-point diagnostic first.

hello@chinagateway.pro