China’s PIPL: What International Marketers Need to Know

What Is China’s PIPL?

The Personal Information Protection Law (PIPL) is China’s first comprehensive law on personal data. It was passed on 20 August 2021 and came into force on 1 November 2021. For brands targeting Chinese consumers, it matters as much as the GDPR does in Europe.

PIPL is one of three pillars of Chinese data law. The Cybersecurity Law (in force since June 2017) covers network security, and the Data Security Law (in force since September 2021) covers data in general, especially data linked to national security. PIPL focuses on information about identifiable people. The main regulator is the Cyberspace Administration of China (CAC). An amended Cybersecurity Law took effect on 1 January 2026, raising its maximum fines partly to align them with PIPL (DLA Piper, 2025).

This lesson is general education, not legal advice.

Who Does PIPL Apply To?

PIPL does not stop at China’s borders. Under Article 3, it also applies to organisations outside China handling data on people in China in order to sell to them or to analyse their behaviour. A UK retailer shipping to Shanghai can therefore be caught. Such organisations must also set up an entity or appoint a representative in China (Article 53).

Key Rules for Marketers

Consent sits at the centre. Article 13 lists the legal bases for handling personal data. Consent comes first, followed by bases such as performing a contract and legal duties. There is no “legitimate interests” basis of the kind many UK and EU marketers rely on (IAPP, 2021), so marketing beyond fulfilling an order will usually need consent.

Some activities need “separate consent”. This is a specific, stand-alone agreement, not a tick inside a general privacy policy. It is required for sensitive personal information, sharing data with another business, making it public, and transferring it outside China. Sensitive information includes biometrics, health data, financial accounts, location tracking and all data about children under 14 (Article 28).

No unfair price discrimination by algorithm. Article 24 says automated decision-making must be transparent and fair, with no “unreasonable differential treatment” in trading conditions such as price. This targets what Chinese consumers call “big data killing the familiar” (dà shùjù shā shú): using purchase data to charge loyal customers more than newcomers.

A right to switch off personalisation. Businesses using automated decision-making for marketing must also offer a non-personalised option or an easy way to refuse (Article 24). This directly limits AI-driven hyper-personalisation.

Heavy penalties. Serious breaches can bring fines of up to RMB 50 million or 5% of the previous year’s turnover (Article 66).

Sending Data Out of China

Under PIPL, data leaving China must use one of three routes: a CAC security assessment, a standard contract filed with the regulator, or certification by an approved body. Critical infrastructure operators and very large data handlers must also store data inside China.

In March 2024, the CAC relaxed these rules through the Provisions on Promoting and Regulating Cross-Border Data Flows. Counted from 1 January each year, the thresholds for ordinary businesses are:

• Exempt: fewer than 100,000 people’s non-sensitive data, or transfers truly necessary to perform a contract with the individual (such as delivering an order) or for HR management.
• Standard contract or certification: 100,000 to 1 million people’s non-sensitive data, or sensitive data on fewer than 10,000 people.
• Security assessment: more than 1 million people’s non-sensitive data, or sensitive data on more than 10,000 people.

The third route was completed when the CAC and the market regulator issued certification measures in October 2025, which took effect on 1 January 2026.

Enforcement in Practice

The best-known case is Didi, China’s biggest ride-hailing company. In July 2022, the CAC fined it RMB 8.026 billion (about US$1.2 billion) under the Cybersecurity Law, Data Security Law and PIPL together. The 16 violations included collecting 11.96 million screenshots from users’ photo albums and 107 million facial recognition records (DigiChina, 2022). The CAC also runs regular campaigns naming apps that over-collect data or ignore consent, and orders them to fix the problems.

A case closer to international marketing came in September 2025. Chinese public security authorities said the Shanghai branch of Dior had sent customer data, including contact details, purchase histories and preferences, to its French headquarters without a security assessment, without separate consent and without encryption. The problem came to light after a data leak in May 2025, and an administrative penalty was imposed (Reuters, 2025).

How PIPL Differs from the EU and UK Model

PIPL borrows much from the GDPR, including rights of access and deletion and impact assessments. But there are three important differences. First, with no legitimate interests basis, much data-driven marketing that is lawful in the UK needs explicit agreement in China. Second, “separate consent” adds an extra layer for transfers and sensitive data. Third, enforcement is more state-centred. Comparing PIPL with the GDPR and California’s CCPA, Calzada (2022) stresses that it must be read within China’s wider approach to state data governance. The CAC and police act directly, alongside national security goals. For a wider comparison, see our overview of data privacy regulations.

Summary

China’s PIPL has been in force since 1 November 2021 and applies to overseas businesses that sell to, or analyse, people in China. It relies on consent, requires separate consent for sensitive data and overseas transfers, bans unfair algorithmic price discrimination and lets consumers refuse personalised marketing. Data leaving China needs a security assessment, standard contract or certification, although the 2024 rules exempt smaller flows. The Didi and Dior cases show these rules are enforced. Compliance is also a matter of marketing ethics: being open about data use builds trust.