ChinaPersonal Information Protection Law of the PRC, General Processing Rules and Lawful Bases
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location
- Audit expectation
- none
What it requires
- Establish one of PIPL's enumerated lawful bases, most commonly informed consent, before collecting or processing personal information of a person in China.NIST Privacy FrameworkCT.PO-P1
- Limit personal information processing to the minimum scope and duration necessary for a stated, specific purpose.NIST Privacy FrameworkGV.PO-P1
- Where personal information is entrusted to a third party processor, execute a written entrustment agreement and supervise that processor's handling; the processor may not exceed the agreed purpose or method and must return or delete the data when the entrustment ends.NIST Privacy FrameworkID.DE-P3NIST Privacy FrameworkID.DE-P5
- Where two or more processors jointly decide a shared processing purpose and method, agree in writing on each party's respective duties; the individual may still exercise rights against any one of them, and the processors bear joint and several liability for resulting harm.NIST Privacy FrameworkID.DE-P3
- Apply the same processing duties to a government agency's processing of personal information as to private processing.
These lines are LexLint's reading of the law's text. Also read by: Cyberspace Administration of China (国家互联网信息办公室), the national cyberspace department that coordinates personal information protection and supervision under the Personal Information Protection Law (guidance, recorded ); Supreme People's Court Guiding Case No. 265, Luo v. a technology company, privacy and personal information protection dispute, adopted by the Judicial Committee of the Supreme People's Court and released (recorded ).
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- ID.DE-P5Data processing ecosystem parties are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual, interoperability framework, or other obligations.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://www.court.gov.cn/shenpan/xiangqing/474481.html
- Guidance link
- https://www.cac.gov.cn/2025-04/09/c_1745906286623776.htm
- Case citation
- Supreme People's Court Guiding Case No. 265, Luo v. a technology company, privacy and personal information protection dispute, adopted by the Judicial Committee of the Supreme People's Court and released
- Guidance body
- Cyberspace Administration of China (国家互联网信息办公室), the national cyberspace department that coordinates personal information protection and supervision under the Personal Information Protection Law
- Open questions
- What scope is reasonable under 在合理的范围内 ("within a reasonable scope") when personal information is processed for news reporting and public opinion supervision in the public interest under Article 13(1)(5)?
What it makes you log
Logging duty
Articles 1 to 23 and 33 to 37 set the principles, the lawful bases, notice and consent, entrusted processing and the rules for state organs. None of them requires a log, register or record of processing. Article 21 requires a handler that entrusts processing to put the terms in an agreement and to supervise the processor, which is a supervision duty with no record named. The records of processing and the impact assessment report are required by Articles 55 and 56, held on a separate row. Article 19 limits how long personal information is kept and is storage limitation, not a log retention period.
- Kind
- None
- As of
What this law does
China's omnibus personal-data statute (Ge Ren Xin Xi Bao Hu Fa, Personal Information Protection Law) requires a lawful basis, most commonly informed consent, before processing personal information, and otherwise contract necessity, statutory duty, public-interest journalism, information the individual or another lawfully disclosed, or another legal ground.
It imposes purpose-limitation and data-minimization duties, requires a handler that entrusts processing to a third party to supervise that processor's activity under an agreement, and assigns joint and several liability among two or more processors who jointly decide a shared processing purpose and method. Chapter II, Section 3 (Arts. 33-37) extends parallel duties to state organs, so the Act binds government processors as well as private ones.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .