Law / China

Personal Information Protection Law of the PRC, General Processing Rules and Lawful Bases

PIPL Arts. 1-23, 33-37; adopted by the Standing Committee of the 13th National People's Congress, 20 August 2021; effective 1 November 2021

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 November 2021.

A comprehensive regime rule binding public and private bodies.

As of 23 August 2026.

What it requires

Establish one of PIPL's enumerated lawful bases, most commonly informed consent, before collecting or processing personal information of a person in China.
Limit personal information processing to the minimum scope and duration necessary for a stated, specific purpose.
Where personal information is entrusted to a third party processor, execute a written entrustment agreement and supervise that processor's handling; the processor may not exceed the agreed purpose or method and must return or delete the data when the entrustment ends.
Where two or more processors jointly decide a shared processing purpose and method, agree in writing on each party's respective duties; the individual may still exercise rights against any one of them, and the processors bear joint and several liability for resulting harm.
Apply the same processing duties to a government agency's processing of personal information as to private processing.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

China's omnibus personal-data statute (Ge Ren Xin Xi Bao Hu Fa, Personal Information Protection Law) requires a lawful basis, most commonly informed consent, before processing personal information, and otherwise contract necessity, statutory duty, public-interest journalism, information the individual or another lawfully disclosed, or another legal ground.

It imposes purpose-limitation and data-minimization duties, requires a handler that entrusts processing to a third party to supervise that processor's activity under an agreement, and assigns joint and several liability among two or more processors who jointly decide a shared processing purpose and method. Chapter II, Section 3 (Arts. 33-37) extends parallel duties to state organs, so the Act binds government processors as well as private ones.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

Read the law

official CAC-published full Chinese statutory text

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app