PIPL compliance consulting for personal information handled in and from China.

What it is

What is the PIPL and what is it used for?

The Personal Information Protection Law of the People's Republic of China, known as the PIPL, is the national statute on handling personal information. It sets when processing is lawful, gives individuals rights, places duties on the organisations that decide how information is handled (personal information processors), adds stricter rules for sensitive categories and controls provision of personal information outside China.

It reaches beyond China's borders. Processing inside mainland China is covered, and so is processing abroad where the purpose is to offer products or services to people in China or to analyse or assess their behaviour, and in other cases set by law or administrative regulation. The Cyberspace Administration of China (CAC) coordinates protection work and supervision nationally, with other State Council departments acting within their own remit.

Current text. The PIPL was adopted on 20 August 2021 at the thirtieth session of the Standing Committee of the thirteenth National People's Congress and has applied since 1 November 2021, in 8 chapters and 74 articles. CAC measures on compliance audits apply from 1 May 2025, and CAC and State Administration for Market Regulation measures on certification for outbound transfers apply from 1 January 2026.

Who it is for

Who needs PIPL compliance?

Any organisation handling personal information in mainland China falls within the law, whatever its size, and so can a company abroad that sells into China. Clients usually come to Sterling for one of four reasons:

• A customer or partner sends a data protection questionnaire. Buyers, platforms and banks ask how Chinese personal information is protected and transferred, and expect records, not just a policy.
• A tender or partnership requires evidence of compliance. Joint ventures and outsourcing bids now carry PIPL clauses, audit rights and transfer terms.
• The regulator's rules now touch your operations. Compliance audits, standard contract filings and the transfer certification route turn principles into dated tasks.
• Group companies share personal information across borders. Regional HR systems, global CRMs and offshore support desks each create an outbound flow that needs its route decided.

Compliance is a state you maintain, not a document you obtain.

Requirements

What are the main PIPL requirements?

The law has eight chapters; the obligations an organisation operates sit mainly in the five below, with sensitive information a section of its own. This is a summary at title level; your programme is checked against the text itself, with your legal advisers.

• General provisions: scope, including processing outside China aimed at people in China, and principles of lawfulness, necessity, openness, accuracy and security.
• Processing rules: a legal basis for every activity, from consent to contract, human resources management and legal obligations; informed and separate consent where the law requires it; limits on retention; entrusted processing and sharing under agreed terms.
• Sensitive personal information: biometrics, health, financial accounts, whereabouts, religious belief, specific identity and the information of children under fourteen, processed only for a specific purpose and where sufficiently necessary, with strict protection measures and the individual's separate consent.
• Cross-border provision: one of the recognised routes before information leaves China, which are the CAC security assessment, personal information protection certification or the CAC standard contract, plus local storage where the law requires it.
• Individuals' rights: to know and decide, access and copy, transfer to another processor where CAC conditions are met, correct, delete, have processing rules explained and, for next of kin, certain rights after death, with a mechanism for handling requests.
• Processor obligations: internal rules, classification, encryption and access control, training, incident plans, a person in charge and a representative in China where required, regular compliance audits, impact assessments and breach notification.

Compliance route

How do you achieve PIPL compliance?

There is no certificate at the end of a PIPL programme. The outcome is an organisation that can demonstrate compliance: to the CAC or another competent department, to the auditors who conduct its compliance audits and to its own customers.

1. 01
   Establish scope and roles.Identify the entities, systems and data subjects involved, whether Article 3 reaches you from outside China, and whether a representative in China or a person in charge is needed.
2. 02
   Gap analysis: compare current practice with the law.Inventory processing and outbound flows, test notices, consents, contracts and security controls against each chapter, and agree actions with owners and dates.
3. 03
   Implement controls and choose transfer routes.Settle legal bases, rewrite notices, complete impact assessments, prepare the security assessment filing, standard contract or certification each flow requires, and train the people involved.
4. 04
   Conduct the compliance audit.An internal audit, or one by a professional institution you commission, tests processing against the law; findings are corrected with evidence and reported to management.
5. 05
   Maintain and respond.Keep the inventory and routes current as systems change, answer requests and incidents on record, repeat audits on the required cycle and meet regulator or customer reviews from existing evidence.

Check the route before you sign. If you choose the certification route, confirm that the certification institution has filed with the CAC, which publishes the institutions that have completed filing, and verify its qualification directly. Treat any offer of a "PIPL compliance certificate" issued in days with suspicion: no such certificate exists for compliance with the law as a whole. The certification buyer's checklist

Cost

How much does PIPL compliance cost?

Cost depends on how personal information moves through your organisation more than on headcount. A subsidiary with local systems needs less effort than a group running Chinese data on global platforms. A Sterling proposal lists every element and states everything that is included.

Timeline

How long does PIPL compliance take?

Most organisations need four to nine months to reach a programme they can defend, a working estimate rather than a regulatory figure. Many outbound flows, sensitive categories and route filings push it longer; decisions and authority procedures take more time than documents.

Share any fixed customer or audit date at the start, and we will say plainly what is achievable.

Your engagement

What your PIPL engagement includes

Sterling runs PIPL work on Sterling OS™. You choose the level of support: Design™, where we guide your team as it does the work, or Drive™, where we carry the work for you under your oversight. Sustain™ keeps the programme current once it is in place, and Automate™ is Effivity, the software the programme runs on.

• Scope, gap analysis and programme plan

  Entities, systems and flows agreed, with owners and dates, before implementation starts.

• Notices, consents, contracts and procedures

  Prepared for your processing on Sterling's own template sets,, in the languages you need.

• Effivity ISO & GRC software

  Inventory, assessments, requests and audits run in Effivity from the start, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Transfer route preparation

  Impact assessments and the documents for a security assessment filing, a standard contract filing or a certification application, prepared with your legal advisers.

• Compliance audit readiness

  An internal compliance audit conducted or facilitated as agreed, with findings closed before any external review.

Sterling does not certify, assess on behalf of the CAC or give legal advice; decisions on filings and certification rest with the authorities and the filed certification institutions.

Often combined with

Standards organisations pair with PIPL (China)

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.