Glossary
PIPL (个人信息保护法, Personal Information Protection Law)
Definition
The Personal Information Protection Law of the People's Republic of China — adopted August 20, 2021, at the 30th session of the Standing Committee of the 13th National People's Congress, in effect since November 1, 2021 (Article 74). It governs the processing of personal information in the mainland. It also applies to processing outside the mainland of personal information of persons inside the mainland when the purpose is offering products or services to persons in the mainland or analyzing and assessing their behavior (Article 3). English renderings on this page are writer translations of the Chinese official text published at npc.gov.cn, not official translated quotes.
What PIPL is
- A PRC statute, not a filing or license. Adopted 2021-08-20, effective 2021-11-01 per Article 74. The law text is published by the National People's Congress at
npc.gov.cn. - Extraterritorial under defined conditions. Article 3 extends the law to offshore processing of mainland persons' personal information when the purpose is offering products or services to persons in the mainland, or analyzing and assessing their behavior. This is the provision that matters to any foreign company whose China-facing site sits offshore but serves mainland users.
- The law behind cross-border personal-information transfers. Chapter 3 requires one of three mechanisms to provide personal information abroad: a security assessment organized by the national cyberspace department, certification by a professional institution under its rules, or the standard contract that department issues with the overseas recipient (Article 38). The processor must also notify the individual and obtain separate consent (Article 39).
- A localization trigger for a defined class. Critical information infrastructure operators and processors whose personal-information volume reaches the prescribed quantity must store mainland-collected and -generated personal information inside the mainland. Cross-border provision from that class passes the security assessment (Article 40).
- Separate from the ICP filing pipeline. The on-site filing pipeline — provider submission, 12381 SMS verification, provincial review, number issuance, public-security registration — contains no PIPL step. The filing comes from the MIIT pipeline; PIPL is a different statute from a different authority.
What PIPL is not
- Not part of the ICP filing. The ICP filing registers a mainland-hosted site with MIIT. PIPL governs personal-information processing. They are separate instruments with separate authorities. The filing pipeline has no PIPL step.
- Not limited to mainland-hosted sites. Article 3's offshore applicability conditions mean the law can reach an offshore-hosted site that targets mainland users with products or services, or analyzes their behavior. Hosting location alone does not determine whether PIPL applies.
- Not satisfied by an infrastructure choice. Selecting a mainland CDN or hosting provider addresses performance and filing obligations. It does not satisfy PIPL — that is a separate legal layer, not an infrastructure property.
Why PIPL matters for foreign companies
A localized data privacy strategy is the compliance layer beyond the filing. Operating without an ICP license or a localized data privacy strategy puts your brand at constant risk of domain blocking — PIPL is the statute that phrase refers to. Article 3 means the obligation can reach an offshore-hosted site serving mainland users — not only mainland-hosted ones.
Cross-border transfers have defined mechanisms. If your China operation sends personal information to servers abroad — for CRM, analytics, or HQ reporting — Article 38 prescribes the mechanisms. Article 39 adds the notification and separate-consent requirement. Which mechanism applies, the volume thresholds, and the 2024 exemptions are set out in our cross-border data transfer term page. Plan the transfer basis before the integration goes live.
Localization applies to a defined class. Article 40 requires certain operators — critical information infrastructure operators and processors above a prescribed volume threshold — to store mainland-collected and -generated personal information inside the mainland. Whether your operation falls into this class turns on the prescribed thresholds.
Common misconceptions
"PIPL is the ICP filing's data chapter." They are separate instruments. The ICP filing pipeline — provider submission, MIIT SMS verification, provincial review, number issuance, public-security registration — has no PIPL step. PIPL is a standalone statute.
"It only applies if we host in the mainland." Article 3 extends the law to offshore processing when the purpose is offering products or services to mainland persons or analyzing their behavior. An offshore-hosted China marketing site can fall within scope.
"Our CDN or infrastructure choice satisfies PIPL." It does not. Infrastructure decisions address performance and filing obligations; PIPL compliance is a separate legal layer.
Frequently asked questions
What is PIPL and who does it apply to?
PIPL is the Personal Information Protection Law of the People's Republic of China, effective November 1, 2021. It governs the processing of personal information in the mainland. Article 3 extends the law to processing outside the mainland when the purpose is offering products or services to persons in the mainland or analyzing and assessing their behavior.
Is PIPL the same as China's personal data law, data protection law, or privacy law?
PIPL is the statute behind those phrases. Its operative subject is personal information, not personal data, and PIPL terminology casts the regulated party as the personal information handler; many international teams phrase the same role as the data controller. The names "personal data security law" and "information security law" are not statute names. The three statutes in this space are PIPL, which governs personal information; the Data Security Law, the all-data framework statute covering non-personal data as well; and the Cybersecurity Law, the framework cybersecurity statute.
How does PIPL handle cross-border data transfers?
Article 38 requires one of three mechanisms: a security assessment organized by the national cyberspace department, certification by a professional institution, or the standard contract that department issues with the overseas recipient. Article 39 adds a notification and separate-consent requirement. Which mechanism applies, the volume thresholds, and the 2024 exemptions are set out on the cross-border data transfer term page.
What does PIPL mean for a foreign company with a China-facing site or app?
Article 3 means the law can reach an offshore-hosted site that targets mainland users with products or services or analyzes their behavior. Hosting location alone does not determine whether PIPL applies. A localized data privacy strategy is the compliance layer beyond the filing.
How does PIPL relate to the Data Security Law and the Cybersecurity Law?
PIPL governs personal information; the Data Security Law is the all-data framework statute — the PIPL's sibling, not its parent. The Cybersecurity Law is the framework cybersecurity statute, and the 2025 amendment's renumbered Article 42 makes the CSL–PIPL cross-reference explicit in the law text. The three are separate statutes.
What should a company do first to address PIPL obligations?
Determine whether Article 3 offshore applicability conditions reach your operation. If your China operation sends personal information abroad, plan the transfer basis before the integration goes live — Article 38 prescribes the mechanisms. PIPL compliance is a separate legal layer from the ICP filing and from infrastructure choices like CDN or hosting selection.
Related terms
- Data Residency in China — the requirement that personal information collected and generated inside the mainland be stored on servers inside the mainland — for a defined class of operators.
- Cross-Border Data Transfer in China — the provision of personal information collected inside the mainland to a recipient outside the mainland.
- CAC (Cyberspace Administration of China) — China's national cyberspace regulator.
- Data Security Law (DSL) — China's framework law for data processing; source of the "important data" trigger that feeds the cross-border security assessment.
- Sensitive Personal Information (敏感个人信息) — the PIPL Article 28 category set and the Article 29 separate-consent condition, for the data class the cross-border threshold ladder tracks separately.
- CIIO (Critical Information Infrastructure Operator) — the regulator-designated operator class that triggers Article 40 storage localization alongside the volume threshold.
Related reading
- PIPL Compliance for Foreign Companies — the operational layer: lawful bases, the Art. 17 notice, the Art. 53 representative, PIPIA, and the penalty ladder.
- ICP Filing vs ICP License — the other compliance layer, and how the filing and license differ.
- ICP Filing Timeline: Phase-by-Phase — the compliance calendar PIPL sits outside of.
- ICP Compliance Service — how we coordinate filing, entity, and hosting decisions.
- Data Residency in China — the storage-side term; the Article 38/40 mechanics.
- Data Security Law (DSL) — the all-data framework statute; the PIPL's sibling, not its parent.
- Cybersecurity Law (CSL) — the framework cybersecurity statute; the 2025 amendment's renumbered Article 42 makes the CSL–PIPL cross-reference explicit in the law text.
- China Digital Entry Glossary — the full term set in one place.
Serving mainland users from an offshore site — and unsure what PIPL reaches?
We coordinate the filing, entity, and hosting decisions so your domain goes live filed and stays online. Start with the ICP & compliance service or the 10-point China readiness diagnostic.
hello@chinagateway.pro