Data protection & privacy law in China (2026)

Legal framework

Personal Information Protection Law (PIPL, effective 1 November 2021), operating alongside the Cybersecurity Law (CSL, 2017; first amendment effective 1 January 2026) and the Data Security Law (DSL, 2021), with the Cyberspace Administration of China (CAC) as lead regulator.

Key points: data & privacy in China

1. 01Primary law and effective date

   The Personal Information Protection Law (PIPL), passed 20 August 2021 and in force since 1 November 2021, is China's first omnibus personal-data statute; it applies to processing of PI of individuals in China and has extraterritorial reach where the purpose is to provide products/services to, or to analyze, individuals in China.

   twobirds.com gibsondunn.com

2. 02Supervisory authority

   The Cyberspace Administration of China (CAC) is the lead regulator, coordinating with MIIT, the Ministry of Public Security, SAMR and sector regulators. The CAC issues implementing rules, runs security assessments, conducts audits, imposes fines, and orders takedowns of non-compliant apps and services.

   trade.gov practiceguides.chambers.com

3. 03Core obligations and individual rights

   Handlers must have a lawful basis (typically consent), give clear notice, run personal-information protection impact assessments, appoint a DPO where thresholds are met, and secure the data; sensitive personal information (biometrics, health, financial account, religion, geolocation, minors under 14) requires separate, informed consent and strict safeguards. Individuals have rights of access, copy, correction, deletion, restriction, portability and withdrawal of consent.

   iapp.org dlapiperdataprotection.com

4. 04Cross-border data transfers (framework completed Jan 2026)

   PIPL provides three legal pathways for exporting personal information: a CAC-led security assessment (valid three years), CAC-approved Standard Contractual Clauses, and CAC certification. The Measures for Certification of Cross-Border Personal Information Transfer (CAC/SAMR, 14 Oct 2025) took effect 1 January 2026, completing the framework; GB/T 46068-2025 certification technical requirements take effect 1 March 2026.

   chambers.com china-briefing.com

5. 05Penalties

   For serious violations, administrative fines can reach RMB 50 million or 5% of the prior year's turnover, alongside confiscation of illegal gains, service suspension, and revocation of business licenses. Directly responsible individuals can be fined up to RMB 1 million and barred from senior/DPO roles; serious data misuse can trigger criminal liability under the Criminal Law (up to 7 years).

   iapp.org jonesday.com

6. 062026 enforcement and rule-making activity

   In January 2026 the CAC published a Q&A tightening expectations on facial recognition, PIPIAs and DPO duties; a Filing of Compliance Audits for Minors' Personal Information (Dec 2025) set an annual audit-filing duty with the first deadline 31 January 2026; and CAC/MIIT/MPS jointly issued the Measures for the Administration of Cybersecurity Labels in May 2026, while continuing the 2026 special campaign against non-compliant apps.

   china-briefing.com twobirds.com

Timeline of decisions

1. 1 Jan 2025Law · official
   Network Data Security Management Regulations take effect

   Issued by the State Council on Sept 30, 2024, these administrative regulations operationalize the CSL, DSL and PIPL together, clarifying personal-information rules, important-data management and cross-border obligations for domestic and foreign processors.

   State Council (gov.cn)

2. 22 Mar 2024Guidance · official
   CAC eases cross-border data transfer rules

   The Provisions on Promoting and Regulating Cross-Border Data Flows introduced volume thresholds and broad exemptions (e.g. employee data, contract-necessary transfers, <100,000 individuals), substantially relaxing the export-compliance burden to attract investment.

   U.S. Library of Congress (Global Legal Monitor)

3. 1 Jun 2023Guidance
   Standard Contract for outbound personal information takes effect

   The CAC's Standard Contractual Clauses Measures created a China-specific SCC mechanism (alongside security assessment and certification) as a lawful route for exporting personal information overseas under the PIPL.

   China Briefing

4. 1 Sept 2022Guidance
   Security Assessment Measures for outbound data take effect

   The CAC's Measures required mandatory government security review for large-scale or sensitive cross-border data exports and by critical information infrastructure operators, the first hard implementation of the PIPL/DSL export regime.

   China Briefing

5. 21 Jul 2022Enforcement
   Didi Global fined RMB 8.026 billion (~$1.2bn)

   The CAC concluded a year-long probe finding 16 violations of the CSL, DSL and PIPL, including illegal collection of 64.7 billion records and sensitive data. It remains China's largest data-protection penalty and signaled aggressive enforcement.

   DigiChina (Stanford), translating CAC

6. 1 Nov 2021Law
   Personal Information Protection Law (PIPL) takes effect

   China's first comprehensive data privacy law, often compared to the GDPR, established consent rules, data subject rights, cross-border transfer conditions, and penalties up to 5% of annual turnover. It completed the trio of pillars governing personal data security obligations.

   DLA Piper

7. 1 Nov 2021Law · official
   Personal Information Protection Law (PIPL) takes effect

   Adopted 2021-08-20, the PIPL is China's first comprehensive data-privacy law, governing consent, cross-border transfers, and platform handling of personal information, with GDPR-like extraterritorial reach. It completes the CSL-DSL-PIPL data governance triad underpinning online regulation.

   National People's Congress

8. 1 Nov 2021Law
   Personal Information Protection Law (PIPL) takes effect

   Adopted Aug 20, 2021, the PIPL is China's first comprehensive national personal-data law, a GDPR-style regime establishing consent rules, individual rights, processing principles and cross-border transfer requirements. It is the cornerstone of the current framework.

   DigiChina (Stanford), translating NPC

9. 1 Jan 2021Law
   Civil Code privacy and personal-information chapter takes effect

   Adopted May 28, 2020, China's first Civil Code dedicated a chapter (Book IV) to privacy and personal information, defining the right to privacy and consent-based processing as civil rights and laying groundwork for the PIPL.

   China.org.cn

10. 28 Dec 2012Law · official
    NPC Decision on Strengthening Network Information Protection

    This 12-clause NPC Standing Committee decision was China's first national instrument with the force of law to protect citizens' electronic personal data, requiring consent, real-name registration and limits on disclosure, an early privacy milestone.

    U.S. Library of Congress (Global Legal Monitor)

Sources

1. 1.twobirds.com/en/trending-topics/china-privacy-and-data-protection
2. 2.dlapiperdataprotection.com/index.html?c=CN
3. 3.practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/china
4. 4.china-briefing.com/news/china-personal-information-protection-key-compliance-signals-fro
5. 5.chambers.com/articles/the-final-piece-of-chinas-cross-border-personal-information-
6. 6.china-briefing.com/news/china-cross-border-data-transfer-certification/
7. 7.iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-2-obligations-an
8. 8.iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-4-penalties-and-
9. 9.jonesday.com/en/insights/2021/09/highlights-of-chinas-new-personal-information-pro
10. 10.gibsondunn.com/china-passes-the-personal-information-protection-law-to-take-effect-o
11. 11.trade.gov/market-intelligence/china-laws-data-security-and-personal-information
12. 12.twobirds.com/en/insights/2026/china/china-cybersecurity-and-data-protection-monthl