A European retailer with a modest Tmall storefront recently asked us a deceptively simple question: do we need to do anything special to email a Shanghai customer a shipping update? The honest answer is that the question itself — once dismissed as paranoia — is now the right one to ask. China's Personal Information Protection Law has settled into something resembling normal operations, and the regulators have been clear that "we did not realise it applied to us" is not a defence.
This piece is written for data-processing teams who have read the statute, found it abstract, and want a usable baseline.
What PIPL actually demands of a foreign processor
PIPL has extraterritorial reach. If you process the personal information of individuals located in China for the purpose of offering them goods or services, or analysing their behaviour, you are within scope — regardless of where your servers sit. That single sentence has done more to reorganise global data architectures than any other provision in the law.
Practically, foreign processors should assume four baseline obligations:
- A lawful basis for every processing activity, with consent treated as the default rather than the convenient option.
- A designated representative or dedicated institution inside China, with contact details filed with the relevant authority.
- A published privacy notice in Chinese that mirrors the actual data flows, not a translated EU template.
- A documented mechanism for any transfer of personal information out of mainland China.
None of these are exotic. What catches teams out is the granularity. PIPL distinguishes between general personal information and "sensitive" personal information — a category that includes biometrics, financial accounts, health, location tracking and any data on minors under 14 — and the consent standard rises sharply for the latter.
Consent, separately and specifically
European teams arriving at PIPL with a GDPR mindset tend to underestimate the consent regime. PIPL does not merely require consent; in several scenarios it requires separate consent — a distinct, affirmative act for each of the following:
- Processing sensitive personal information.
- Providing personal information to a third party (including intra-group recipients outside the original processor).
- Public disclosure of personal information.
- Transferring personal information outside mainland China.
- Using personal information for purposes beyond those originally notified.
"Separate" is the operative word. A single tick-box covering all data uses will not survive scrutiny. In practice this means layered consent flows: a primary notice at sign-up, and discrete prompts at the moment a new processing purpose engages. Teams that have built granular consent management for GDPR can usually adapt; teams relying on broad legitimate-interests reasoning have more rebuilding to do, because PIPL does not offer a directly equivalent basis for commercial processing.
Withdrawal must also be as easy as granting consent — a point regulators have raised in enforcement notices against apps with friction-laden opt-out paths.
The three cross-border transfer routes
Any movement of personal information from mainland China to a recipient abroad — including to your own headquarters — triggers the cross-border data transfer rules. There are three principal routes, and choosing between them is now the most consequential decision in a China data programme.
CAC security assessment. Mandatory for transfers by critical information infrastructure operators, for transfers of "important data", and for processors above defined volume thresholds. This is a government-led review conducted by the Cyberspace Administration of China. It is the slowest and most demanding route, requiring a self-assessment report, detailed data mapping and a formal application.
Standard Contractual Clauses (China SCCs). A template contract issued by the CAC, executed between the exporter in China and the overseas recipient, supported by a Personal Information Protection Impact Assessment and filed with the provincial CAC. Suitable for most mid-volume corporate transfers and the workhorse mechanism for foreign multinationals.
Certification. Issued by a CAC-accredited body, useful particularly for intra-group transfers within a multinational. Adoption has been slower but it is a viable third option.
Subsequent regulatory guidance has softened the regime at the margins — certain low-volume transfers, HR data necessary for employment, and contract-performance transfers have been given lighter treatment — but the architecture stands. The question for your team is not whether you fall under one of these mechanisms, but which one, and whether the paperwork would survive an inspection.
A realistic compliance baseline
Most foreign processors do not need a perfect programme. They need a defensible one. A defensible PIPL posture, in our experience, contains the following:
- A current data inventory that identifies which datasets contain Chinese personal information and where they live.
- A documented lawful basis for each processing activity, with consent records that are retrievable per data subject.
- A Chinese-language privacy notice that matches the actual practice, refreshed when products change.
- A signed and filed cross-border transfer instrument — usually the China SCCs — with the supporting impact assessment kept under version control.
- A designated in-China contact, named in the privacy notice, capable of receiving regulator correspondence and data subject requests.
- A breach response plan with a clearly identified Chinese-language communications path to affected users and authorities.
- Annual review cadence, because thresholds, exemptions and guidance documents continue to evolve.
What this baseline deliberately omits is heroics. You do not need to onshore every workload, nor do you need a parallel China stack for every product. You need to know what data you hold, why you hold it, where it goes, and which document supports each movement.
Where foreign teams most often slip
Three recurring failure modes are worth flagging. The first is treating PIPL as a translation exercise — adopting the GDPR notice with Chinese subtitles, which fails on consent granularity and on the cross-border disclosure obligation. The second is forgetting that processor-to-processor transfers within a corporate group are still cross-border transfers. The third is conflating the data-localisation rules (which apply to specific operators and data categories) with PIPL itself, and either over-engineering or under-engineering as a result.
China data privacy work rewards specificity. If a particular dataset or product line is keeping your team up at night, it is usually faster to test the analysis against PRC-qualified counsel than to refine the spreadsheet a further time. Serene Jade's Chinese Lawyer service exists precisely for that: English-led access to bar-admitted PRC and Hong Kong lawyers for the questions that genuinely need a local answer.
FAQ
Does PIPL apply if our only China-facing activity is a multilingual website that happens to accept Chinese customers? If you are actively offering goods or services to individuals in China — pricing in RMB, shipping into China, providing Chinese-language support — the extraterritorial trigger is likely engaged. Incidental access without targeting is the borderline case and worth a specific legal view.
Can we rely on the China SCCs for transfers to a US parent company for global analytics? Often yes, provided the volume sits below the thresholds that mandate a CAC security assessment and you have completed the Personal Information Protection Impact Assessment. Analytics use cases attract scrutiny because they frequently expand purposes over time, so the impact assessment needs to anticipate that.
What happens if a data subject withdraws consent after we have already transferred their data abroad? You must stop further processing tied to that consent and arrange deletion or anonymisation where no other lawful basis applies. Build the downstream deletion path before launch; retrofitting it across a transferred dataset is where most teams discover their data map was incomplete.
For teams building or remediating a China data programme, Serene Jade's Chinese Lawyer service connects you directly with PRC and Hong Kong qualified counsel for the questions that need a local answer.