Before you read
This site is NOT legal advice, and using it creates no lawyer and client relationship. It is a set of findings, checked against published sources and dated, that may help software developers and other individuals. For a decision that matters, ask a qualified lawyer in the country concerned.
China
Sources last checked:
China’s Personal Information Protection Law, the PIPL, took effect on 1 November 2021.1 Its official text is in Chinese.
Source note: the English text at the National People’s Congress could not be reached. This page was written from a machine summary of the Chinese text published by the Cyberspace Administration of China, not a line-by-line reading.
Who it covers
Processing in China, and processing abroad of data about people in China, in order to offer them products or services or to analyse their behaviour.2
Legal reasons to use data
Consent, a contract, a legal duty, an emergency and certain other listed grounds.3 Consent can be withdrawn, and there must be an easy way to do so.4
Your rights
You can know and decide about your data,5 access and copy it,6 have it corrected7 and, in listed cases such as withdrawn consent, have it deleted.8
Children
Processing the data of a child under 14 requires consent from a parent or guardian.9
Sending data abroad
A transfer needs a listed condition, such as a state security assessment, certification or a standard contract.10 People must be told about the recipient, and separate consent obtained.11
Security incidents
If a leak, alteration or loss has happened or may happen, the organisation must act at once and tell the regulator and the people affected, unless the measures taken effectively prevent harm.12
Fines
Serious violations can bring fines of up to 50 million yuan or 5% of the previous year’s turnover.13
Related law
Amendments to the Cybersecurity Law took effect on 1 January 2026.14
Source note: this rests on the National People’s Congress news item as returned by a search; the amended law itself was not read.