PIPL, explained
China's Personal Information Protection Law governs covered handling of personal information and related protections.
- The field
- Legal
- Reading time
- 1 minute
- In this entry
- Meaning · relevance · limits
The meaning
China's Personal Information Protection Law governs covered handling of personal information and related protections.
Why it matters
Projects with relevant processing in or relating to China need a specific assessment of purposes, permissions and cross-border arrangements.
The boundary
A hosting region does not by itself answer whether this law applies to an application.
Consider users as well as server location
A service hosted outside China analyses the behaviour of people located inside China. Its operator should review the Personal Information Protection Law’s territorial scope and the processing involved. The assessment starts with what the service does and whom it serves, rather than assuming that an overseas virtual machine creates an exemption.
- The law includes certain overseas processing intended to provide products or services to people in China or analyse their behaviour.
- Review sensitive information and cross-border provisions separately; do not infer a universal transfer permission.