China · Compliance
Personal Information Protection Law (PIPL) compliance in China
Achieve Personal Information Protection Law (PIPL) compliance in China with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- Compliance, end to end
- Shanghai office team
- Effivity software included
- Academy training included
Who asks for Personal Information Protection Law (PIPL) in China
Clients include
Personal Information Protection Law (PIPL) compliance in China at a glance
Personal Information Protection Law of the PRC is the instrument itself: it applies to the organisations within its scope, and buyers and partners in China ask for evidence that you meet it.
A regular compliance audit is written into China's Personal Information Protection Law itself. Since the law came into force on 1 November 2021, handlers have had to secure personal information through internal rules, classification, encryption, access control, training and incident plans; to carry out impact assessments before sensitive processing or cross-border provision; and to audit their own compliance. The Cyberspace Administration of China has since issued audit measures that set frequency and allow regulators to order a commissioned audit, while the Network Data Security Management Regulations add duties for very large handlers. Transfers abroad need a CAC security assessment, personal information protection certification by an approved body, or the CAC standard contract. Overseas companies serving people in China can fall within the law and must appoint a local representative. There is no general PIPL certificate; compliance is shown through records, assessments and audit reports. Sterling's Shanghai office maps processing, drafts the documentation and prepares clients for audits and filings, with Effivity and Sterling Academy included.
Who needs Personal Information Protection Law (PIPL) in China, and what happens without it
These are the organisations in China that most often need to show Personal Information Protection Law (PIPL).
- Any organisation processing personal information of natural persons in ChinaThe PIPL applies to processing in China and, in defined cases, to processing outside China.
- Large-scale handlers (personal information of more than 10 million people)Compliance audits at least once every two years under the CAC audit measures.
- Multinationals transferring personal information out of ChinaCross-border provision needs a CAC security assessment, certification or the standard contract, plus an impact assessment.
- Banks, insurers and PBOC-supervised businessesSector data security measures add obligations to the PIPL baseline.
- Overseas companies offering products or services to people in ChinaMust set up a dedicated entity or appoint a representative in China.
Not sure which of these applies to you?Answer a short set of questions and your readiness report arrives by e-mail.
Take the free readiness checkPersonal Information Protection Law (PIPL) requirements in China
Strip away the vocabulary and China's PIPL asks a personal information handler to comply in six areas of data processing.
In China these six sit alongside the local laws and regulations listed under drivers below; one system can evidence both. The detail is on the global hub: Personal Information Protection Law (PIPL) explained →
How to achieve Personal Information Protection Law (PIPL) compliance in China
One team from the Shanghai office carries the work from scoping to sign-off. Delivery from the Shanghai office, on-site across mainland China as the scope requires; remote delivery for distributed teams.
- Discovery call and scopeEntities, locations, regulators and target date, agreed before any proposal.
- Gap assessment against Personal Information Protection Law (PIPL) and the Chinese requirements that apply to youControls you already run for your regulators and customers are reused, not rebuilt.
- Your system built with your team in EffivityRisks, controls, evidence, incidents and reviews in one live system the auditor can see.
- Internal audit, management review and corrective actionsYour internal auditors trained by Sterling; the evidence proven before any external review.
- Reviews by regulators, customers and auditorsSterling supports the reviews your regulators, customers and auditors run.
- End to end, from one team
- Effivity ISO & GRC software
- Preferential Sterling Academy access, with complimentary awareness training for your people
- Internal auditor training for your audit team, as applicable to your standard
- Vulnerability assessment on ISMS engagements
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements.Sterling does not certify. Certification decisions stay with independent bodies.
How long does Personal Information Protection Law (PIPL) compliance take in China?
There is no standard duration: it depends on your scope and on how much of the system already runs. In China these are the factors that set the timeline.
- Volume and sensitivity of personal information processed
- Number of systems, vendors and cross-border data flows
- Whether a CAC filing, assessment or certification is needed for transfers
- State of existing records, notices and consent mechanisms
Sterling agrees a dated plan with you on the discovery call, once the scope is known.
How much does Personal Information Protection Law (PIPL) compliance cost in China?
The cost has two parts: the consulting work to build and prove the system, and any external assessor’s fees, which are quoted separately. In China these factors move both.
- Number of processing activities and systems in scope
- Cross-border route chosen and its filing or certification effort
- Commissioned compliance audit by a professional institution where required
- Integration with ISO/IEC 27001 or ISO/IEC 27701 controls
Sterling gives one customised, all-inclusive proposal after the discovery call, never before the scope is agreed.
Personal Information Protection Law (PIPL) consultants and assessors in China
Two different organisations are involved. A consultant helps you build the system and prove it works; your regulators, customers and auditors then audits or assesses it and decides. Keeping the two separate is what makes the result credible to buyers and regulators.
- Check that the body’s accreditation or approval covers Personal Information Protection Law (PIPL) and your sector, and that its certificates can be verified online.
- Ask the consultant how the local requirements in China are mapped into the same system, so nothing runs twice.
- Ask for client references in your sector; Sterling’s client letters are available on request.
- Agree who owns the evidence and the tool after the engagement; with Sterling the system stays yours, in Effivity.
Laws and regulations that drive Personal Information Protection Law (PIPL) in China (4)
| Instrument | How it treats the standard |
|---|---|
| Personal Information Protection Law of the PRC | The instrument itself Compliance obligations, regular compliance audits and impact assessments. |
| Measures for Personal Information Protection Compliance Audits (CAC) | Implementing rules Audit frequency and commissioned audits. |
| Network Data Security Management Regulations (State Council Decree No. 790) | Implementing regulation Regular compliance audits; rules for handlers of more than 10 million people's personal information. |
| Personal Information Protection Certification (SAMR and CAC Announcement 2022 No. 37) | Official certification route Voluntary, by approved certification bodies under the implementation rules; one of the PIPL cross-border conditions. |
Accreditation, audit language and remote audits in China
PIPL is a law: compliance is evidenced by records of processing, notices and consents, impact assessments, compliance audit reports, cross-border filings and contracts. The official personal information protection certification is carried out only by approved certification bodies under the SAMR/CAC implementation rules; cross-border security assessments are conducted by the CAC. Sterling prepares the evidence; it does not certify or approve. Edition and transition details: Personal Information Protection Law (PIPL) hub →
Audit language
Filings with the CAC and Chinese-language notices are required for individuals in China; internal records may be bilingual.
Remote and on-site
Most compliance work can be run remotely with document and system access; interviews and system walkthroughs may be on-site.
Personal Information Protection Law (PIPL) in China: questions clients ask
Does the PIPL apply to a company outside China?
It can. The PIPL reaches processing outside China of personal information of people in China where the purpose is to offer them products or services, to analyse or assess their behaviour, or in other cases the law sets. An overseas handler within that scope must set up a dedicated entity or appoint a representative in China. Ask counsel to confirm your case.
How often must a PIPL compliance audit be done?
Handlers audit themselves regularly. Under CAC's published Q&A, a handler processing the personal information of more than 10 million people must carry out a compliance audit at least once every two years. Departments may also require a handler to commission a professional institution at its own cost. Confirm the current rule with the CAC or counsel.
What are the routes for transferring personal information out of China?
The PIPL sets four routes: a CAC security assessment, personal information protection certification by a professional institution under CAC rules, a CAC standard contract, or other conditions set by law. A protection impact assessment is also needed before providing personal information outside China. Take legal advice on which fits your flow.
Is there a PIPL certificate?
Yes, but it is voluntary. Personal information protection certification is carried out by approved certification bodies under the Implementation Rules, following SAMR and CAC Announcement 2022 No. 37, and it is one of the PIPL cross-border conditions. The law itself does not issue a certificate; compliance is shown through records and reports.
More on Personal Information Protection Law (PIPL) for Chinese organisations
Other standards Chinese businesses ask Sterling for
Organisations in China often combine Personal Information Protection Law (PIPL) with one of these, under one management system where the scopes allow.
Start with a free discovery call from the Shanghai office
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- Personal Information Protection Law of the PRC — cac.gov.cn (accessed 5 Oct 2026)
- Measures for Personal Information Protection Compliance Audits (CAC) — gov.cn (accessed 5 Oct 2026)
- Network Data Security Management Regulations (State Council Decree No. 790) — gov.cn (accessed 5 Oct 2026)
- Personal Information Protection Certification (SAMR and CAC Announcement 2022 No. 37) — gov.cn (accessed 5 Oct 2026)
Talk to a consultant
Plan your certification with the Shanghai team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
china@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice