Top-5 Operational Impacts of China’s PIPL

Last Updated: March 2022

China’s Personal Information Protection Law, or PIPL, enacted Nov. 1, 2021, has rewritten the rules of the global privacy landscape. Many commentators have described it as one of the strictest privacy regimes on the planet. Akin to EU General Data Protection Regulation, it also applies extraterritorially to companies that handle any personal data from China, provide products or services to Chinese residents, or analyze the behavior of Chinese consumers.

This five-part IAPP series, the “Top-5 Operational Impacts of China’s PIPL,” is written by a host of experts on Chinese law. It explores the most important features of China’s PIPL, from requirements around sensitive personal information, data subject rights and international data transfers, to the bases for handling data, DPO responsibilities, and enforcement mechanisms and penalties. The IAPP Resource Center hosts a "China" topic page, and links to in-language and English translations of the PIPL can be found in the IAPP's "Global Privacy Law and DPA Directory".

Part 1: Scope, key definitions and lawful processing of data
Published: February 10, 2022
In the first part of the series, Morrison & Foerster Partner Paul McKenzie outlines the PIPL's scope, key definitions and requirements for lawful handling of personal information.

Part 2: Obligations and rights
Published: February 17, 2022
In the second part of the series, Rui Bai Law Head of Corporate Barbara Li analyzes the law's legal obligations on businesses in relation to the collection, processing, provision, transfer, deletion and destruction of personal data.

Part 3: Personal information protection officer
Published: February 24, 2022
In the third part of the series, Xiaomi Head of Security and Privacy Compliance Wenkuan Song analyzes the law's personal information protection officer requirement with a look into which companies need to appoint an officer, general responsibilities and more. 

Part 4: Penalties and enforcement mechanisms
Published: March 3, 2022
In the fourth part of the series, Ian Wang, senior partner of leading PRC law firm DeHeng Law Offices, analyzes how the PIPL provides comprehensive penalty and enforcement mechanisms, including administrative penalties, private actions, public interest actions (China’s equivalent of class actions), public security administration, and criminal penalties.

Part 5: International data transfers
Published: March 17, 2022
In the final article of the series Covington & Burling Partner Yan Luo, Associate Irina Danescu and Legal Consultant Vicky Liu provide an overview of the law's scope for cross-border data transfers and the potential transfer mechanisms at companies' disposal.