Last reviewed: August 2026 · Cadence: monthly (sooner on major releases) · Centre: Data Privacy & Cybersecurity · Guides: PIPL · Transfer roadmap · PIPL vs GDPR.
How to useStatus legend
Watch listCurrent priorities
Stack mapPIPL · DSL · CSL
Transfer pathwaysQuick matrix
ChangelogUpdates
Ops checklistAfter each update
How to use this tracker
- Privacy leads own the monthly scan; IT/HR join when transfer or HRIS rows move.
- Status legend: Stable baseline · Active evolution · Monitor · Interface (cyber/trade/sector).
- For project delivery, open the transfer roadmap; for dual-compliance, open PIPL vs GDPR.
Watch list — current priorities (Aug 2026)
| Theme | Status | Operator impact | Owner | Related |
|---|---|---|---|---|
| PIPL core program | Stable baseline + Active evolution | Notices, bases, sensitive PI, rights, processors, penalties mindset | Privacy + Legal | B13 PIPL guide |
| Cross-border PI transfers | Active evolution | Pathway choice (assessment / standard contract / certification); HQ admin access; SaaS | Privacy + IT | B14 roadmap |
| Employee / HRIS data | Stable baseline · high practical risk | Global HR systems, monitoring, payroll vendors | HR + Privacy | First hire · B13 employees |
| App / SDK / marketing stacks | Active (platform enforcement) | Tracker sprawl, mini-programs, app-store takedowns | Marketing + Product | B13 customers |
| Data Security Law — important data | Interface · Monitor | Non-PI datasets; sector catalogues; outbound data restrictions | Cyber + Legal | Data centre |
| Cybersecurity Law / MLPS | Interface · Stable baseline | Network security baselines; procurement diligence | Security | Data centre cyber section |
| AI training & inference data | Interface · Active | Prompts, logs, corpora; overlaps GenAI rules | Privacy + AI product | B18 AI tracker · B17 |
| GDPR dual compliance | Monitor (program design) | Reuse inventories; rebuild China transfer module | Global privacy | B15 comparison |
Stack map (what sits next to PIPL)
| Layer | Business question | Primary portal entry |
|---|---|---|
| PIPL | Are we processing personal information lawfully and transparently? | PIPL guide |
| Outbound PI | Can HQ/cloud systems lawfully receive China PI? | Transfer roadmap |
| DSL | Is this “important data” or other regulated data—not only PI? | Counsel + sector lists |
| CSL / MLPS | Are networks and systems secured to expected baselines? | Security program |
| AI rules | Do model products add labelling/filing/safety duties? | AI tracker |
Transfer pathway matrix (quick scan)
| Pathway family | When teams usually consider it | Program shape |
|---|---|---|
| Security assessment | Higher scale / higher risk / elevated operator categories | Long calendar; regulator-facing file |
| Standard contract | Many MNC subsidiary → HQ / shared SaaS designs (if eligible) | Contract + impact assessment + filing discipline |
| Certification | Eligible group/processor scenarios | Certification scope & renewal |
Eligibility and thresholds change—run the full roadmap project before promising board dates. Do not treat EU SCCs as a China pathway (PIPL vs GDPR).
Changelog
| Date | Change | Why it matters |
|---|---|---|
| 2026-08 | Tracker launched (v1.0). Watch list, stack map, transfer matrix; linked to B13/B14/B15 and AI tracker B18. | Gives privacy/IT a single monthly scan page and clear handoff to project roadmaps. |
Next planned refresh: add instrument-level footnotes and exemption watch items as rules are published.
After each tracker update — internal ops
- [ ] Diff Watch list against China data-flow inventory
- [ ] Re-open transfer pathway status if thresholds/guidance moved
- [ ] Check HRIS, CRM, support, and marketing SDK changes since last review
- [ ] Confirm Chinese notices still match processing
- [ ] Sync with AI product owners (prompts/logs/training)
- [ ] Update board residual-risk language (China vs EU modules)
- [ ] Stamp “privacy tracker reviewed [date]” in compliance calendar
Related & counsel
Data privacy centre PIPL guide Transfer roadmap AI tracker Find counsel
General information only—not legal advice. Trackers lag primary sources and implementing measures. Verify before filings, transfers, or product launches. China Legal Portal Editorial.