PIPL · 01 Editorial guide

PIPL Scope, Algorithm Duties and AI Training Data (Personal Information)

PIPL attaches to processing facts, not a system label. Classify the information, handler, purpose, lawful basis, sensitive-data trigger and recipient before asking whether consent or an export mechanism is required.

First job Identify what is processed, who is the handler and which PIPL duties actually attach.

Start here

Decision railwhat data → handler role → PI or not → AI/algorithm overlay → transfer gate → evidence

See routing facts

Start here

Key considerations

The first questions are about urgency, governance and preservation — before collection expands or interviews begin.

What personal information is processed in or from China?
Who decides purposes and means, and who acts only on instructions?
Which lawful basis, sensitive-information rule or overseas-recipient duty is relied upon?

Direct answer

What this page decides

Owner
02

This page owns PIPL: what is personal information, who is the handler, notice/consent and core duties. AI01 algorithm filing and AI04 training-data PI are spokes here, not a new L3. If the model trains on personal or sensitive PI, PIPL (and often Data Security Law) attach before any ‘AI regulation’ slogan. Copyright in training corpora is IP. Overseas model APIs facing China users are Cross-border transfers + FDI sector overlay (AI05). Supporting: /china-consumer-digital-compliance-algorithm-pipl. Do not invent filing catalogues or PI volume thresholds.

At a glance

Which fact changes the next route

Use the fact that changes ownership or urgency to decide the next move.

Facts that change the next investigation route
Question	Why it matters	Next route
Need CAC algorithm filing?	Public recommendation/generation duties.	Programme L4 for the filing file; this page for PI overlay.
Training on user content?	PI + copyright.	This page + IP training-data spoke.
Foreign model, China users?	AI05.	Cross-border transfers L4.
Labelling generated content?	AI03.	Programme L4 labelling row.

Scope

What this page owns — and what it does not

PIPL core + AI PI overlay. No new AI hub.

Exclusionscopyright (IP); VATS/ICP (FDI sector); financial-sector AI (Fintech L4 overlay).

Practical workflow

Action, evidence, legal gate, output

Practical workflow
Action	Documents / evidence	Legal gate	Output
Inventory processing	Systems, vendors, models	PI vs non-PI vs sensitive PI	Map
If a model or recommender is in scope	User-facing vs internal	Algorithm/genAI rules may add duties	AI overlay list
Training-data PI	Sources, consent, sensitive PI	Do not scrape first	PI training file
Export or API	Where the model sits	Transfers L4	Route

Documents

What to gather before the next call

These items help clarify the file; they are not a legal requirement list.

Documents to gather before instructing counsel
Item	Why needed	Who holds it	Risk if missing
Processing inventory including models	PIPL map	Privacy	Shadow AI
Training-source log	PI provenance	Product	Unlawful PI set

Common failure points

Where files usually break

Calling internal ChatGPT use ‘not PIPL’ because it is ‘just a tool’.
Standing up a second /china-ai-law hub.

FAQ

Narrow follow-ups owned by this page

Is there a China AI legal-guides L3?

No. Data is the parent for PI/algorithm/filing; IP for copyright; FDI for access; Fintech for licensed financial models.

Decision map

Keep the question bounded.

Map the processingMap collection, use, storage, disclosure and deletion by purpose, system, person category and location.
Name the handlerSeparate independent, joint and entrusted processing and allocate notices, contracts, rights and incidents.
Test the lawful basisConsent is one basis, not the only basis. Record necessity, separate-consent and impact-assessment triggers.

Regulatory gates

Approvals that can hold signing or closing.

This map does not decide whether a filing is required on your facts.

HREmployee data

Document necessity under lawfully adopted employment rules or collective contracts; do not convert the HR basis into unlimited reuse.

SensitiveSensitive personal information

Specific purpose, sufficient necessity, strict protection, additional notice and separate consent where consent is the basis.

FaceFacial recognition

Test necessity and a non-face alternative, local storage, PIPIA, separate consent and the 100,000-person filing threshold.

ExportOverseas recipient

Move the flow to the transfer route; a PIPL lawful basis does not itself clear export formalities.

Quick answers

Need the short version? Start with one narrow question.

These explainers answer one question. They do not replace this topic route or a deep guide.

Quick AnswerChina PIPL: Personal Information Protection LawPIPL is China’s core PI statute: who it covers, what personal information is, and how it sits next to DSL and CSL. Reviewed 6 Sep 2026.Reviewed 2026-09-06 Quick AnswerSensitive Personal Information Under PIPLSPI under PIPL is a closed-ish list (biometrics, medical, financial accounts, location, minors under 14, etc.) that needs separate consent and a stricter PIA. Reviewed 6 Sep 2026.Reviewed 2026-09-06 Quick AnswerPersonal Information Handler Under PIPLA PIPL personal information handler is the organisation that decides purpose and means — closer to a GDPR controller than to a processor. Reviewed 6 Sep 2026.Reviewed 2026-09-06 Quick AnswerConsent Under PIPLPIPL consent must be informed, voluntary and explicit for the processing described — and it is not the only lawful basis. Reviewed 6 Sep 2026.Reviewed 2026-09-06 Quick AnswerSeparate Consent Under PIPLPIPL separate consent is a distinct, unbundled yes for listed high-risk acts — SPI, export, public disclosure — not another paragraph in the same tick-box. Reviewed 6 Sep 2026.Reviewed 2026-09-06 Quick AnswerEntrusted Processing Under PIPLPIPL entrusted processing is the handler–vendor model: a contract, instruction limits, and no secondary purposes. It is not joint processing and not a CBDT path by itself. ReviewedReviewed 2026-09-06

Curated resources

Open the asset that matches this job.

core guide

China data compliance decision guide

National PIPL, transfer and cybersecurity decision desk — not a substitute for a filing pack.

deep guide

PIPL key rules

What counts as personal information and the core handler duties.

checklist

PIPL compliance checklist

A structured prompt for processing, vendors and transfer evidence.

primary source

Personal Information Protection Law

Official national text governing personal-information processing, sensitive information, individual rights, handler duties and cross-border provision.

primary source

Facial Recognition Security Measures

Effective 1 June 2025: necessity, alternatives, separate consent, local storage, impact assessment, security and filing requirements.

Helpful to prepare

Facts that make the next conversation clearer.

These items are orientation aids, not a legal requirement list.

Processing inventory in non-confidential termsChina entity and overseas affiliates involvedLawful basis, notice and separate-consent matrixSensitive information, minors, biometrics and facial-recognition inventoryRights-request, retention, deletion and PIPIA evidence

Counsel hand-off

What to bring when you instruct

Instruct privacy counsel (IP if corpus is copyrighted). Bring: systems list, model use, and whether users in China see the output.

Local context

Add the city when regulator practice changes.

CAC and industry-regulator practice can differ after the national transfer or cybersecurity question is identified.

Open city and province guides

Counsel hand-off

Need data-privacy counsel?

This hub organises PIPL, cybersecurity and export questions. It does not decide whether a transfer is lawful or whether notice is required on your facts.

Find data-privacy counsel

Submit an initial enquiry

Legal review

Who reviewed this guide

Need qualified counsel?

Move carefully. Move with a record.

Use the portal to identify counsel for this practice and related China-side issues.

Find data-privacy counsel Submit an initial enquiry