What is Personal Information Protection Law (PIPL)?

PIPL applies to processing personal information within China, and to processing outside China when the purpose is to provide products or services to people in China, to analyse or evaluate their behaviour, or in other cases set by law. Personal information is any information relating to an identified or identifiable person, excluding anonymised data, and processing covers collection, storage, use, transmission, provision, disclosure and deletion.

Organisations outside China that fall under these rules must set up a specialised body or appoint a representative in China to handle personal information matters.

Article 13 lists the legal bases for processing. Consent is one. Others include processing that is necessary to conclude or perform a contract with the individual, processing necessary for human resources management under lawfully made labour rules and collective contracts, and processing needed to meet legal duties. Where consent is the basis, it must be voluntary, explicit and fully informed, and it can be withdrawn.

Sensitive personal information includes biometrics, religious belief, medical health, financial accounts, whereabouts and the data of children under 14. It may be processed only for a specific purpose, when necessary and with strict protection, and the law calls for the individual's separate consent.

Applicants are not yet employees, so confirm which legal basis covers candidate data before relying on the human resources ground. Before processing, tell candidates who you are, why and how you process their data, which categories you collect, how long you keep them and how they can exercise their rights.

Where you use automated decision making, the law requires transparency and fair results, and individuals can ask for an explanation and refuse decisions made solely by automated means that significantly affect their rights. A personal information protection impact assessment is required in advance for sensitive data, automated decision making, sharing data with other parties and transfers abroad.

Sending personal information out of China needs one of the routes in Article 38: a security assessment by the national cyberspace authority, certification, or a standard contract with the overseas recipient. The individual must also be told about the recipient and give separate consent. Provisions issued by the Cyberspace Administration of China in March 2024 exempt some transfers from the assessment, contract and certification routes, including employee data that is truly necessary for cross-border human resources management under lawful labour rules and collective contracts.

Serious violations can bring fines of up to 50 million yuan or 5 per cent of the previous year's turnover, suspension of business, and personal fines for the people directly responsible.