What PIPL requires
- A lawful basis, usually consent or necessity for a contract or HR management
- Clear privacy notices in Chinese
- Separate consent for sensitive data and for transfers abroad
- Personal information protection impact assessments for higher-risk processing
Cross-border transfers
Depending on volumes and data types, transfers abroad need a CAC security assessment, the standard contract filing or a certification, unless an exemption applies. The 2024 Provisions on Promoting and Regulating Cross-Border Data Flows raised the thresholds and added exemptions, so many companies now need less than they feared.
Related: ICP filing and licence · Employment & work permits
Frequently asked questions
Does PIPL apply if we only have a sales office in China?
Yes, if that office processes personal information, including employee and customer data. Offshore companies can also be covered when they offer products or services to individuals in China.
Can we send employee data to our headquarters?
Usually yes. 2024 rules relaxed several requirements, including an exemption for data that is genuinely necessary for cross-border HR management. Each transfer still needs a legal basis, a notice to employees and proper records.