CevroChina: Personal Information Protection Law (PIPL) 2021 and what it requires
Personal Information Protection Law (PIPL) 2021: an established law with an active enforcement record. Overseen by Cyberspace Administration of China (CAC).
Key requirements at a glance
| Registration with the regulator | Not required |
|---|---|
| Data protection officer | Depends on thresholds or circumstances |
| Breach notification | No fixed hourly deadline in our reference |
| Cross-border transfer restrictions | Required |
| Data localization | Required |
Penalties and enforcement
Fines up to 5% of annual turnover or RMB 50 million.
What to know in practice
Separate consent required for sensitive data; strict cross-border transfer mechanisms and strong extraterritorial reach.
How Cevro helps
- Maps Personal Information Protection Law (PIPL) 2021 to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in China?
Cyberspace Administration of China (CAC) oversees Personal Information Protection Law (PIPL) 2021.
Is breach notification mandatory under Personal Information Protection Law (PIPL) 2021?
Our reference does not record a fixed hourly deadline for Personal Information Protection Law (PIPL) 2021. Check the statute and Cyberspace Administration of China (CAC) guidance for the notification timing that applies to you.
Does China restrict cross-border data transfers?
Yes. Moving personal data out of China is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under Personal Information Protection Law (PIPL) 2021?
Only in some cases, usually depending on the scale or sensitivity of your processing. Confirm whether you cross the threshold.
What are the penalties for non-compliance in China?
Fines up to 5% of annual turnover or RMB 50 million.