China’s PIPL requires control over collection — and every path the data takes next.
China’s Personal Information Protection Law regulates how organizations collect, use, share, disclose, secure and export personal information. The framework includes special requirements for sensitive information, automated decisions, children under 14, entrusted processing and overseas transfers. Captain Compliance helps teams discover digital data collection, configure consent and notices, handle individual requests and organize the records needed to support a defensible PIPL program.
Separate consent matters — but it is only one part of the system.
Personal information may be processed only when a circumstance recognized by Article 13 applies. Consent is one ground, but contractual necessity, qualifying human-resources management, statutory duties, emergencies and other specified circumstances may also apply.
Before processing, individuals generally must receive clear information about the processor, purposes, methods, categories, storage period and procedures for exercising their rights.
When processing relies on consent it must be voluntary, explicit and fully informed. Individuals must have a convenient way to withdraw it, and a material change in the purpose, method or category of information may require renewed consent.
PIPL specifically requires separate consent for certain activities, including processing sensitive personal information, providing information to another personal information processor, public disclosure, and providing personal information outside China.
Sensitive personal information may be processed only for a specific purpose, when necessary, and with strict protective measures. Personal information concerning minors under 14 is sensitive, generally requires guardian consent, and must be governed by special processing rules.
Automated decisions must be transparent, fair and impartial. Personalized information or commercial marketing must include a non-personalized option or convenient refusal method, and individuals receive additional protections for decisions with a significant effect.
Processors must implement organizational and technical safeguards, limit access, train personnel and maintain incident plans. Entrusted service providers require written controls and supervision under Article 21, which is distinct from providing information to another independent processor. Breaches or possible breaches require immediate remediation and applicable notifications.
Individuals receive rights concerning information, decisions, restriction or refusal, consultation and copying, correction, supplementation and deletion. High-risk processing requires a prior PIPIA, and processors must conduct compliance audits.
For serious violations PIPL permits fines of up to RMB 50 million or 5% of the previous year’s turnover. Authorities may also confiscate illegal gains, suspend applications or business activities, revoke permits or licenses, and penalize responsible personnel. PIPL provides potential civil liability, and authorized entities may bring proceedings involving infringements affecting many individuals. These outcomes are not automatic consequences of every violation.
Turn the legal framework into documented operating controls.
Captain Compliance helps privacy, legal, security and engineering teams discover personal-information collection, configure digital choices, coordinate individual requests and preserve evidence. It does not replace Chinese legal advice, CAC filings or accredited certification.
Real-time tracker discovery
Continuously identify cookies, pixels, scripts and other website technologies that may collect personal information, including technologies added after the original review.
Consent and auto-blocking
Configure consent experiences and prevent selected technologies from loading until the organization’s chosen consent conditions have been satisfied.
Separate-consent workflows
Support distinct choices for sensitive processing, independent recipients, public disclosure and outbound transfers, rather than combining every activity into one blanket acceptance.
Versioned processing notices
Publish and preserve notices identifying processing purposes, methods, information categories, storage periods, recipients and rights procedures.
Individual-rights handling
Centralize consultation, copy, correction, supplementation, deletion, restriction, refusal and consent-withdrawal requests with documented outcomes.
PIPIA workflows
Document the purpose, necessity, effects on individuals, security risks and protective measures for sensitive information, automated decisions, entrusted processing, disclosures and outbound transfers.
Vendor and transfer mapping
Connect data flows with entrusted processors, independent recipients, overseas recipients, transfer volumes, data classifications and the proposed cross-border mechanism or exemption.
Audit and incident evidence
Organize policies, consent events, assessments, vendor records, transfer decisions, incident response and remediation evidence for internal review and compliance audits.
The first question is no longer simply which route. It is whether a route is required.
China’s March 2024 rules created exemptions and revised the thresholds for security assessments, standard contracts and certification. Organizations must first classify the data, identify whether they are a critical information infrastructure operator, determine whether important data is involved, and calculate outbound volumes from 1 January of the current year. Exemption may apply — a CAC security assessment, standard contract or certification may not be required in specified situations, including certain contract-performance, cross-border human-resources and emergency transfers; certain information collected outside China and routed through China without introducing domestic personal information or important data; qualifying free-trade-zone activity; and exports by a non-CIIO involving fewer than 100,000 individuals’ non-sensitive personal information during the applicable annual period. An exemption from these transfer mechanisms does not automatically eliminate other PIPL duties. Standard contract or certification — for a non-CIIO, a standard contract or qualifying personal-information export certification generally applies when annual exports involve at least 100,000 but fewer than 1 million individuals’ non-sensitive personal information, or fewer than 10,000 individuals’ sensitive personal information, unless another exemption applies and provided important data is not involved. The Personal Information Export Certification Measures took effect on 1 January 2026. CAC security assessment — generally required when a critical information infrastructure operator exports personal information or important data; a non-CIIO exports important data; annual exports reach at least 1 million individuals’ non-sensitive personal information; or annual exports reach at least 10,000 individuals’ sensitive personal information. Underlying PIPL duties — depending on the activity, organizations may still need outbound-transfer notice, separate consent, a personal information protection impact assessment, measures governing the overseas recipient, a written agreement, records supporting the transfer decision, and a Chinese representative or specialized agency for an overseas processor. Thresholds and exemptions continue to develop, and transfer classification should be confirmed with qualified Chinese counsel.
Build your PIPL readiness plan- Day 1 — Discover collection — Scan the website and identify cookies, pixels, forms, scripts and third-party technologies that may process personal information
- Week 1 — Classify processing — Map processing purposes, Article 13 grounds, sensitive information, automated decisions, recipients, retention and children’s information
- Week 2 — Configure notices and choices — Implement processing notices, consent, withdrawal, separate-consent and marketing-refusal controls where applicable
- Week 3 — Map vendors and exports — Separate entrusted processors from independent recipients and identify every overseas transfer, recipient, volume and data category
- Week 4 — Complete assessments — Conduct PIPIAs for applicable sensitive processing, automation, entrusted processing, disclosures and outbound transfers
- Ongoing — Monitor and audit — Detect changes, maintain request and incident workflows, update transfer volumes and prepare for periodic compliance audits
From blanket consent to traceable PIPL operations.
- Every activity placed under one blanket consent
- Processing grounds not documented
- Vendors and independent recipients treated identically
- Website trackers added without privacy review
- Sensitive information not consistently classified
- Outbound volumes and recipients not tracked
- Transfer routes selected without checking exemptions
- PIPIAs and audit records scattered across departments
- Individual requests handled through ordinary inboxes
- Incident decisions preserved inconsistently
- Processing purposes and grounds mapped
- Separate-consent experiences configured where needed
- Entrusted processors distinguished from other recipients
- Continuous visibility into website technologies
- Sensitive and children’s information flagged for review
- Export destinations, categories and volumes documented
- Exemptions and transfer routes organized for counsel review
- PIPIAs, audits and approvals maintained centrally
- Individual requests routed through documented workflows
- Incident and remediation evidence preserved
China’s PIPL, answered plainly.
What is China’s PIPL?+
Does PIPL apply to companies outside China?+
Is consent always required under PIPL?+
What is separate consent?+
Does PIPL require cookie consent?+
Does every transfer outside China require a standard contract or security assessment?+
Does PIPL require all personal information to remain in China?+
What qualifies as sensitive personal information?+
What rights do individuals receive?+
When is a PIPIA required?+
Know what is collected, where it goes and why it is allowed.
Captain Compliance helps connect tracker discovery, consent, notices, rights handling, assessments and cross-border records in one operating program.
Book a PIPL review View pricing