China PIPL Compliance with ConsentX

What Is China's PIPL?

The Personal Information Protection Law of the People's Republic of China is China's comprehensive personal-information protection statute.

The law aims to:

• Protect personal-information rights and interests
• Regulate personal-information processing
• Safeguard lawful and reasonable use of personal information
• Establish obligations for personal-information processors
• Provide individuals with enforceable rights
• Establish requirements for cross-border data transfers
• Support supervision and enforcement of personal-information processing

PIPL forms part of China's broader data-governance framework alongside laws and regulations concerning cybersecurity and data security.

Organisations Potentially Affected

Potentially affected organisations include:

• Chinese companies
• International companies serving Chinese customers
• E-commerce platforms
• SaaS providers
• Mobile applications
• Advertising platforms
• Analytics providers
• Financial institutions
• Healthcare organisations
• Educational institutions
• Technology companies
• Social platforms
• Employers
• Online marketplaces
• Marketing businesses

What Is Personal Information Under PIPL?

PIPL defines personal information as information recorded electronically or through other means that relates to an identified or identifiable natural person.

It does not include information that has been anonymised. Examples can include:

• Name
• Date of birth
• Identification information
• Telephone number
• Email address
• Account information
• IP address where it relates to an identifiable individual
• Device identifiers
• Location information
• Browsing information
• Purchase records
• Financial information
• Employment information
• Education information
• Biometric information
• Health information
• User profiles
• Behavioural information

China's CAC published updated guidance in January 2026 listing examples including identity information, biometric information, online identifiers, financial information, communications records, browsing records, device information, location information and user-profile information.

What Is Personal-Information Processing?

PIPL covers a broad range of processing activities. Processing can include:

• Collection
• Storage
• Use
• Processing
• Transmission
• Provision
• Disclosure
• Deletion

The law therefore applies across the full personal-information lifecycle.

PIPL Processing Principles

Article 5 requires personal information to be processed according to principles including:

• Lawfulness - processing must have an applicable legal basis.
• Legitimacy - processing must have a legitimate purpose and should not involve unlawful practices.
• Necessity - processing should be necessary for the stated purpose.
• Good faith - organisations must not use misleading, fraudulent or coercive methods to process personal information.
• Purpose limitation - the purpose should be clear and reasonable, and processing should be directly related to that purpose.
• Data minimisation - collection should be limited to what is necessary.
• Transparency - individuals should receive appropriate information about processing.
• Security - appropriate measures should protect personal information from unauthorised access, loss, alteration and other risks.

These principles form the foundation of PIPL compliance.

Does PIPL Require Consent?

Not for every processing activity.

Consent is one of the lawful circumstances under Article 13, but PIPL also recognises other processing grounds. These can include processing that is:

• Necessary for entering into or performing a contract
• Necessary for human-resources management under legally established labour rules and collective contracts
• Necessary to perform statutory duties or obligations
• Necessary in emergency situations to protect life, health or property
• Conducted for public-interest purposes
• Based on personal information made public by the individual in accordance with the law
• Otherwise authorised by laws or administrative regulations

Therefore, organisations should identify the applicable legal basis for each processing activity rather than automatically requesting consent for everything.

What Makes Consent Valid Under PIPL?

Where consent is relied upon, it should be obtained on the basis of appropriate information and voluntary choice.

Organisations should avoid:

• Deceptive consent interfaces
• Coercive consent
• Unclear purposes
• Excessive data collection
• Bundling unrelated purposes
• Hidden processing purposes
• Making consent unnecessarily difficult to refuse or withdraw

PIPL also establishes separate-consent requirements for specified processing activities.

Separate Consent Under PIPL

Separate consent is particularly important for certain higher-risk processing activities. Examples can include:

• Processing sensitive personal information in specified circumstances
• Providing personal information to other personal-information processors in specified circumstances
• Public disclosure of personal information in specified circumstances
• Cross-border provision of personal information

For international transfers, current CAC guidance confirms that when personal information is provided overseas, the processor must comply with relevant notice and separate-consent requirements where applicable.

ConsentX can support separate consent experiences where a dedicated consent signal is required.

Sensitive Personal Information

PIPL provides enhanced protection for sensitive personal information.

Sensitive personal information is information that, if leaked or illegally used, may easily cause harm to the dignity of a natural person or seriously endanger personal safety or property safety. Examples can include:

• Biometric identification
• Religious beliefs
• Specifically designated identities
• Medical and health information
• Financial accounts
• Information concerning an individual's whereabouts
• Other sensitive information recognised under applicable rules

The exact classification depends on the nature and context of the information.

Requirements for Sensitive Personal Information

Before processing sensitive personal information, organisations should assess:

• Whether processing is necessary
• Whether a specific purpose exists
• The potential impact on individuals
• The applicable legal basis
• Appropriate security controls
• Whether separate consent is required
• Retention requirements
• Disclosure and transfer requirements

PIPL requires additional notification concerning the necessity of processing sensitive personal information and its impact on individuals' rights and interests.

Where consent is the legal basis, separate consent is required for sensitive personal information under PIPL, subject to applicable statutory exceptions.

Children's Personal Information

PIPL provides enhanced protections for minors.

Personal information of individuals under 14 years of age is treated as sensitive personal information. Organisations processing such information must establish dedicated processing rules and apply additional safeguards. Where consent is required, parental or guardian consent may be necessary.

This is particularly relevant to:

• Children's applications
• Education platforms
• Gaming services
• Social platforms
• E-commerce
• Online advertising
• Family-oriented digital services

Privacy Notices Under PIPL

PIPL requires personal-information processors to provide clear information to individuals.

Privacy information can include:

• Identity and contact information of the processor
• Purpose of processing
• Processing methods
• Categories of personal information
• Retention period
• How individuals can exercise their rights
• Other information required by law

The information should be presented in a clear and understandable manner.

For sensitive personal information, organisations should additionally explain the necessity of processing and the impact on individual rights and interests.

Privacy Policy and Consent Banner

A cookie or consent banner should not be treated as a replacement for a full PIPL privacy policy.

A compliant digital experience may require a privacy notice, purpose information, applicable consent, separate consent where required, technical enforcement and evidence.

ConsentX can support the technical consent layer while organisations maintain the broader privacy documentation required by PIPL.

Cookies and Tracking Under PIPL

Cookies, pixels and other tracking technologies should be assessed based on the personal-information processing they perform.

Organisations should consider:

• What information is collected
• Whether individuals can be identified
• Why the technology is used
• Whether the data is transferred to another party
• Whether the technology involves sensitive information
• Whether consent is required
• Whether information is transferred outside China
• How long information is retained

Common technologies include:

• Analytics cookies
• Advertising pixels
• Social-media trackers
• Session-recording tools
• Marketing tags
• Personalisation technologies
• Conversion trackers
• Third-party embedded content

Where consent is the appropriate legal basis, ConsentX can help prevent applicable trackers from executing before the required consent signal.

Data Subject Rights Under PIPL

PIPL grants individuals extensive rights concerning their personal information. These include rights to:

• Know
• Decide
• Restrict processing
• Refuse processing
• Access
• Copy
• Correct
• Supplement
• Delete
• Request explanations concerning processing rules
• Exercise applicable rights concerning automated decision-making

PIPL also allows individuals to request that their rights be exercised through a designated person or institution under applicable conditions.

Right of Access and Copy

Individuals can exercise rights to access and copy their personal information.

Organisations should establish workflows to:

• Receive requests
• Verify identity
• Identify relevant systems
• Locate personal information
• Review applicable restrictions
• Produce the required information
• Record the response

Right to Correction and Supplementation

Individuals can request correction or supplementation of inaccurate or incomplete personal information.

Organisations should maintain mechanisms for:

• Verifying requests
• Updating source systems
• Updating downstream processors
• Maintaining consistency
• Recording changes

Right to Deletion

Individuals can request deletion where statutory conditions are met.

Deletion may become relevant when:

• The processing purpose has been achieved
• The processing purpose cannot be achieved
• The processing is no longer necessary
• Consent is withdrawn where consent is the legal basis and no alternative basis applies
• Processing violates applicable laws
• Other statutory circumstances apply

Organisations should maintain documented deletion and retention procedures.

Right to Withdraw Consent

Where processing is based on consent, individuals have the right to withdraw consent.

Withdrawal should be practical and should not be made unnecessarily difficult. The organisation should be able to:

• Identify the relevant consent
• Record withdrawal
• Stop applicable processing
• Update downstream systems where required
• Maintain an audit record
• Continue only where another lawful basis independently permits the processing

ConsentX can provide the technical infrastructure for managing these preference changes.

Automated Decision-Making

PIPL contains specific provisions concerning automated decision-making.

Where automated decision-making is used, organisations should consider:

• Transparency
• Fairness
• Whether decisions produce unreasonable differential treatment
• Individual rights
• Opt-out or alternative mechanisms where applicable
• Restrictions on automated decisions in circumstances specified by law

The 2025 compliance-audit framework specifically instructs auditors to examine whether automated decision-making based on preferences or transaction habits results in unreasonable differential treatment.

This is relevant to:

• AI systems
• Recommendation engines
• Credit scoring
• Recruitment
• Advertising
• Personalisation
• Fraud detection
• Automated eligibility decisions

Personal Information Protection Impact Assessment

PIPL requires a Personal Information Protection Impact Assessment (PIPIA) before certain high-risk processing activities.

Article 55 identifies circumstances including:

• Processing sensitive personal information
• Using personal information for automated decision-making
• Entrusting processing to another party
• Providing personal information to another processor
• Publicly disclosing personal information
• Providing personal information outside China
• Other processing activities that have a significant impact on individuals

The assessment should examine:

• Whether processing purposes and methods are lawful, legitimate and necessary
• The impact on individual rights and interests
• Security risks
• Whether protective measures are appropriate and effective

PIPIA records must be retained for at least three years.

Impact Assessments and Consent Management

Consent management can form one part of a broader PIPIA.

For example, an organisation can document:

• What cookies are deployed
• What information they collect
• Why they are used
• Which third parties receive the information
• Whether consent is required
• What happens before consent
• What happens after withdrawal
• How consent evidence is maintained

ConsentX can provide technical evidence for this part of the assessment.

Data Security Under PIPL

Personal-information processors must implement appropriate measures to protect personal information.

Security controls can include:

• Access controls
• Authentication
• Encryption
• De-identification
• Security monitoring
• Employee training
• Incident-response processes
• Vendor controls
• Data classification
• Backup and recovery
• Internal policies

PIPL requires processors to establish personal-information protection systems and take appropriate security measures based on the type and scale of processing.

Personal Information Protection Officer

PIPL requires certain processors handling personal information at the threshold prescribed by the national cyberspace authority to appoint a person responsible for personal-information protection.

That person is responsible for supervising personal-information processing activities and protective measures.

The processor must also disclose the relevant contact information and submit required information to the competent authorities. Organisations should determine whether their processing volume and activities trigger this obligation.

Representatives for Overseas Organisations

An organisation outside China that falls within the extraterritorial scope of PIPL must establish a dedicated institution or appoint a representative in China to handle personal-information protection matters where required by Article 53.

The organisation must submit the relevant information about the institution or representative to the competent authorities.

This is an important consideration for international businesses serving Chinese users.

Compliance Audits Under PIPL

China's compliance framework has developed significantly since the original PIPL came into force. The Personal Information Protection Compliance Audit Measures took effect on 1 May 2025.

The rules establish two main audit scenarios. Under the regular internal or professional audit, personal-information processors should periodically conduct compliance audits, and processors handling the personal information of more than 10 million individuals must conduct a personal-information protection compliance audit at least once every two years.

Under the regulatory-required audit, competent authorities can require an organisation to engage a professional institution for a compliance audit where significant risks, large-scale impacts on individuals or certain serious personal-information security incidents are identified.

This makes ongoing evidence and privacy governance increasingly important for large processors.

Personal Information Protection Compliance Audit

The compliance-audit framework covers areas including:

• Lawful processing
• Consent
• Separate consent
• Privacy notices
• Data minimisation
• Retention
• Individual rights
• Processor relationships
• Security
• Automated decision-making
• Sensitive personal information
• Children's data
• International transfers
• PIPIA
• Organisational governance

The 2025 audit rules also provide a detailed audit guide for evaluating these requirements.

International Data Transfers Under PIPL

International transfers are one of the most important parts of China's privacy framework.

Article 38 establishes several mechanisms for transferring personal information outside China, including:

• Passing a CAC-organised security assessment
• Obtaining personal-information protection certification
• Entering into a standard contract with the overseas recipient
• Other conditions established by laws, regulations or the national cyberspace authority

2024 Cross-Border Data Rules

China's Provisions on Facilitating and Regulating Cross-Border Data Flows came into force on 22 March 2024 and adjusted the thresholds and exemptions for cross-border personal-information transfers.

Under the current framework, certain transfers may be exempt from the security-assessment, standard-contract and certification requirements. Examples include specified transfers necessary for:

• Cross-border shopping
• Cross-border delivery
• Cross-border remittance
• Cross-border payments
• Account opening
• Travel bookings
• Visa processing
• Examination services
• Certain cross-border human-resources management
• Emergency protection of life, health or property

There is also an exemption for non-critical-information-infrastructure operators providing fewer than 100,000 individuals' personal information overseas in a calendar year, excluding sensitive personal information and subject to the applicable rules.

Current Cross-Border Transfer Thresholds

For organisations other than critical information infrastructure operators, the current framework broadly distinguishes among the following.

Less than 100,000 individuals. Certain transfers of fewer than 100,000 individuals' personal information in a calendar year may be exempt from the three principal outbound mechanisms, subject to the applicable conditions and exclusions.

100,000 to fewer than 1 million individuals. Where the applicable thresholds are met, the organisation generally needs to use either a personal-information export standard contract or personal-information protection certification, subject to applicable exemptions.

1 million or more individuals. A non-CIIO processor providing personal information of 1 million or more individuals overseas in the relevant period generally falls within the security-assessment requirement, subject to the applicable exemptions.

Sensitive personal information. The threshold for sensitive personal information is substantially lower: providing 10,000 or more individuals' sensitive personal information overseas can trigger the security-assessment framework, subject to applicable exemptions.

Personal Information Export Standard Contract

One route for qualifying international transfers is China's Personal Information Export Standard Contract framework. The contract establishes obligations between the Chinese personal-information processor and the overseas recipient.

Organisations using this mechanism should assess:

• Transfer purpose
• Data categories
• Data-subject categories
• Processing methods
• Overseas recipient
• Security measures
• Individual rights
• Retention
• Incident response
• Applicable regulatory obligations

The standard-contract route should be evaluated alongside the current cross-border data-flow rules rather than treated as automatically necessary for every transfer.

Personal Information Protection Certification

China also provides a certification mechanism for qualifying cross-border transfers. The Personal Information Export Certification Measures were issued in 2025 and came into force on 1 January 2026.

The 2026 framework specifies conditions for non-CIIO processors that, during the relevant calendar year, provide overseas:

• At least 100,000 but fewer than 1 million individuals' non-sensitive personal information, or
• Fewer than 10,000 individuals' sensitive personal information

subject to the applicable rules. Organisations cannot artificially split data volumes to avoid a mandatory security assessment.

Separate Consent for Cross-Border Transfers

When PIPL requires consent for an international transfer, the consent must be appropriately separated from unrelated processing.

The CAC's July 2026 guidance states that separate consent for cross-border provision must be specific and clear and cannot be obtained through blanket authorisation bundled with other personal-information processing activities.

This is particularly relevant to:

• International SaaS platforms
• Global CRM systems
• International cloud services
• Overseas analytics providers
• Global advertising platforms
• Multinational employers
• International customer-support systems

Data Localisation

PIPL requires certain personal information to be stored domestically.

Critical information infrastructure operators are subject to domestic storage requirements for personal information collected and generated in China. Other processors processing personal information up to the threshold prescribed by the national cyberspace authority can also be subject to domestic-storage and security-assessment requirements when exporting information.

Therefore, international organisations should not assume that personal information collected in China can automatically be transferred to global infrastructure.

Data Retention

PIPL requires personal information to be retained only for the shortest period necessary to achieve the processing purpose unless a longer retention period is required by applicable laws or regulations.

Organisations should establish:

• Retention schedules
• Purpose-specific retention periods
• Deletion procedures
• Anonymisation processes
• Backup handling
• Processor deletion requirements

The 2025 compliance-audit framework specifically requires auditors to examine whether organisations define retention periods or the method for determining them and whether the period is the shortest necessary for achieving the processing purpose.

Data Breach Notification

Where personal information is or may be leaked, tampered with or lost, the processor must immediately take remedial measures and notify the competent authorities and relevant individuals as required by PIPL.

The incident-response process should cover:

• Detection
• Containment
• Risk assessment
• Remediation
• Regulatory notification
• Individual notification where required
• Documentation
• Follow-up corrective action

Organisations should not assume that a generic global breach workflow automatically satisfies China's requirements.

Third-Party Processors

Where a personal-information processor entrusts processing to another organisation, appropriate controls should address:

• Processing purpose
• Processing period
• Processing method
• Categories of personal information
• Security measures
• Rights and responsibilities
• Supervision
• Termination
• Deletion or return

PIPL also requires personal-information protection impact assessment in circumstances involving entrusted processing and other specified third-party disclosures.

Privacy by Design

PIPL compliance should be incorporated into digital products and systems from the beginning.

A privacy-by-design programme can include:

• Data minimisation
• Purpose limitation
• Consent management
• Separate consent
• Privacy notices
• Access controls
• Retention controls
• Encryption
• PIPIA
• Vendor management
• International-transfer controls
• DSAR workflows
• Audit logging

Direct Marketing and Personalisation

Digital marketing can involve extensive personal-information processing. Examples include:

• Email marketing
• Behavioural advertising
• Retargeting
• Customer segmentation
• Personalised offers
• Recommendation engines
• Advertising identifiers
• Analytics profiles

Organisations should assess:

• Purpose
• Lawful basis
• Transparency
• Consent requirements
• Automated decision-making
• Third-party disclosures
• International transfers

Where consent is relied upon, organisations should maintain evidence showing what the individual consented to and when.

AI and Profiling Under PIPL

Artificial intelligence and profiling can create significant privacy risks.

PIPL's automated-decision provisions are relevant to:

• AI recommendation systems
• Behavioural profiling
• Automated advertising
• Credit scoring
• Recruitment
• Personalised pricing
• Fraud detection
• Eligibility decisions

The organisation should assess:

• Data sources
• Processing purpose
• Transparency
• Fairness
• Individual rights
• Potential discrimination
• Human intervention
• Security
• PIPIA requirements

The 2025 compliance-audit framework specifically addresses automated decision-making and unreasonable differential treatment.

PIPL Enforcement

China's cyberspace administration and other competent authorities have powers to supervise and enforce personal-information protection requirements.

Regulatory measures can include:

• Orders to correct
• Warnings
• Confiscation of illegal gains
• Fines
• Suspension of business
• Suspension or termination of application services
• Revocation of relevant licences in serious cases
• Personal liability for responsible individuals
• Other legal consequences

The PIPL provides particularly significant sanctions for serious violations.

Who Regulates PIPL?

The Cyberspace Administration of China (CAC) plays a central role in China's personal-information protection framework.

Other competent departments can also have personal-information protection responsibilities depending on the sector and regulatory context.

The PIPL itself refers to departments responsible for performing personal-information protection duties rather than assigning every aspect of enforcement to a single regulator.

PIPL Compliance Checklist

A practical programme should cover the following.

• Map personal-information processing
• Identify personal-information processors
• Identify sensitive personal information
• Identify children's personal information
• Determine applicable legal bases
• Review privacy notices
• Review cookies and trackers
• Determine where consent is required
• Identify separate-consent requirements
• Configure appropriate consent mechanisms
• Block applicable trackers before consent
• Record consent
• Support consent withdrawal
• Establish data-subject rights procedures
• Implement security controls
• Establish breach-response procedures
• Conduct PIPIA where required
• Review third-party processors
• Review international transfers
• Determine whether security assessment is required
• Determine whether standard contract is required
• Determine whether certification is applicable
• Review localisation requirements
• Establish retention periods
• Implement deletion procedures
• Appoint a personal-information protection officer where required
• Establish a China representative where required
• Conduct compliance audits where required
• Maintain compliance documentation
• Monitor CAC regulatory developments

Why PIPL Consent Management Matters

A modern website can involve dozens of technologies that collect, analyse or transmit information. Examples include:

• Analytics tools
• Advertising pixels
• Social-media scripts
• Marketing tags
• Session-recording technologies
• Personalisation systems
• Embedded content
• CRM integrations
• Third-party APIs

PIPL compliance therefore requires more than publishing a privacy policy. Organisations need visibility into what technologies operate on their websites and how personal information is collected and shared.

ConsentX helps organisations discover, categorise, inform, obtain consent, block, record, manage preferences and demonstrate evidence.