Research prompt
Personal information protection
Start with the PIPL when the activity involves identifiable natural persons, processing roles, sensitive personal information, individual rights or overseas provision.
PIPLPersonal informationRights
Data governance · maintained regulatory reference
China Data Privacy Regulatory Tracker.
Use this maintained source map to identify the instrument family that may affect a China data or personal-information workstream. Confirm the activity, data, parties, systems and current official text before drawing a compliance conclusion.
6 topic prompts5 official routes2026-08-21 source check
01 Current instrument set
Use a maintained source set, not one isolated rule
Start with the activity, data and parties, then identify the current instrument family.
China data work can involve the PIPL, network and data-security rules, cross-border transfer mechanisms, important-data or sector requirements and operational guidance. This tracker keeps those routes visible without treating a tag as a legal conclusion.
Source set checked 21 August 2026 by China Legal Portal Editorial. Draft consultation texts are not shown as effective law.
Maintained data-governance reference
Living referencePIPL, network data and cross-border transfer source set
- Current through
- 21 August 2026
- Primary authorities
- National People’s Congress and Cyberspace Administration of China
- Use boundary
- Research orientation only; exact facts and current official texts require professional verification
02 Browse topics
Use prompts to locate the source family
Search the operational question, then verify the official text before drawing any conclusion.
Topic cards and tags are navigation aids. They do not determine whether data is personal or important, whether a transfer exists, or which mechanism applies.
Sources ↓
Research prompt
Network data security
Check the Network Data Security Management Regulations and adjacent cybersecurity or data-security rules for the system, operator and data activity.
Network dataSecurityGovernance
Research prompt
Cross-border transfer route
Map whether the activity is an overseas provision of data, then test exemptions and the current security-assessment, standard-contract or certification route.
Data exportAssessmentSCC
Research prompt
Important data and sector rules
Do not infer important-data status from volume alone. Check notifications, published catalogues, sector rules and applicable FTZ negative lists.
Important dataSectorFTZ
Research prompt
Processor and recipient records
Map controllers or processors, entrusted processing, joint decisions, overseas recipients, contracts, impact assessments and change events.
RolesContractsRecords
Research prompt
Operational change watch
Recheck new systems, SDKs, HRIS or CRM changes, new data fields, recipients, countries, vendors, mergers and incident response.
OperationsVendorsChange
No topic prompt matches those terms.
Try a broader activity, data type, role or transfer term, then review the complete official source set.
03 Official sources
Primary text before interpretation
Keep the instrument, activity and later updates in one research trail.
01
NPC · Personal Information Protection Law
Official NPC English reference text. Confirm the controlling Chinese text and applicable implementing measures.
↗02CAC · Network Data Security Management Regulations
Official text of State Council Decree No. 790, effective 1 January 2025.
↗03CAC · Provisions on Facilitating and Regulating Cross-Border Data Flows
Official CAC publication of the cross-border data-flow provisions effective on publication.
↗04CAC · Standard Contract Measures
Official measures for the standard contract route. Read with later cross-border data-flow provisions and current filing guidance.
↗05CAC · data-governance policy index
Official index for later rules, questions and updates. Draft consultation texts are not treated as effective instruments.
↗04 Additional checks
Data analysis is fact- and change-sensitive
Before selecting a route, preserve the facts that may change the regulatory analysis.
Processing activity
Describe collection, use, storage, access, sharing, transfer, deletion and automated decisions.
Data and people
Identify data fields, sensitivity, scale, affected individuals, important-data indicators and sector context.
Roles and systems
Map processors, entrusted parties, joint decisions, recipients, vendors, systems and access locations.
Mechanism and change
Verify exemptions or mechanisms, impact assessments, contracts, filings and operational change triggers.
05 Related routes
Continue from the source map
Move to the appropriate data decision or counsel resource.
01
Cross-Border Data Guide
Map whether a China data export exists and which current route requires testing.
→02Data & Privacy Lawyers
Find counsel for PIPL, cybersecurity, important-data and transfer questions.
→03Prepare a consultation
Prepare a bounded, non-sensitive description of the activity, data, systems and recipients.
↗Topic counsel
Counsel shortlist for this guide
Profiles matched by practice to this topic. A shortlist for consultation — not an endorsement of any filing, clearance or legal outcome.
Practice-matchedVerified status shown per profileFree initial consultation
Joyce Huang
VerifiedJiushang Law Firm · Beijing · Languages: Mandarin, English
Tongyu Yan
Shanghai AllBright Law Offices · Pudong · Languages: English, Mandarin
Ruiqing Long
Beijing Zhong Lun Law Firm · Chaoyang · Languages: English, Mandarin
Wen Lei
Beijing Jingshi Law Firm · Haidian · Languages: English, Mandarin