Personal Information Protection Law Enterprise Compliance Essentials and Legal Liability

The Personal Information Protection Law (PIPL), effective November 1, 2021, is China's dedicated legislation in the personal information protection field. Enterprises processing personal information must strictly comply.

1. Legal Basis for Personal Information Processing

Processing personal information requires the individual's consent, except in the following circumstances: necessary for concluding or performing a contract to which the individual is a party; necessary for performing statutory duties or obligations; necessary for responding to public health emergencies or protecting natural persons' life, health, and property in emergencies; processing within a reasonable scope for news reporting, public opinion supervision, etc. for public interest; processing within a reasonable scope per law of personal information voluntarily disclosed by the individual or otherwise lawfully disclosed.

2. Notification and Consent Rules

Before processing personal information, the processor must truthfully, accurately, and completely notify in a conspicuous manner and clear, easy-to-understand language: the processor's name and contact information, processing purpose and method, types of personal information processed, retention period, and methods and procedures for individuals to exercise rights. Where processing is based on individual consent, the individual has the right to withdraw consent. Processing sensitive personal information (biometrics, religious beliefs, specific identity, medical health, financial accounts, location tracking, etc.) requires the individual's separate consent, with notification of necessity and impact on individual rights.

3. Cross-Border Personal Information Transmission

Providing personal information abroad requires meeting one of the following conditions: passing a security assessment organized by the national cyberspace administration; obtaining personal information protection certification by a professional institution; concluding a contract with the overseas recipient per standard contract terms; other conditions prescribed by laws and administrative regulations. The individual must also be notified of the overseas recipient's name, contact information, processing purpose, processing method, types of personal information, and methods for exercising rights, with separate consent obtained. Critical information infrastructure operators and processors handling personal information reaching specified quantities must store personal information domestically.

4. Legal Liability

Violations of PIPL are subject to correction orders, warnings, and confiscation of illegal gains by the department responsible for personal information protection; refusal to correct incurs fines up to RMB 1 million; directly responsible supervisors and other directly responsible persons are fined RMB 10,000–100,000. For serious violations, the provincial-level or above personal information protection department orders correction, confiscates illegal gains, and imposes fines up to RMB 50 million or 5% of previous year's turnover, and may order suspension of related business or business suspension and rectification, revocation of relevant business permits or business licenses.