HR is a PIPL basis, not a PIPL holiday — HQ copies and face clocks still need a path.
PIPL allows processing employee PI to implement HR and labour rules in accordance with law. That basis covers many payroll, attendance and statutory-file uses. It does not license extra monitoring, public posting of punishments, SPI without necessity, or a silent sync of the whole HRIS to an overseas HQ. Vendors are entrusted processors. Overseas Workday/SAP is a CBDT path. Employee consent is often the wrong tool when the employee cannot say no. Pair this page with the employment-wiki cluster for labour duties; this page is the PIPL overlay.
4 questions before you choose the route.
This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.
What HR purpose is actually needed?
Payroll vs monitoring vs extras.
PurposeIs it SPI?
Health, accounts, biometrics, location.
SPIWho is the vendor and where is HQ?
Entrusted plus CBDT.
WhereWould a notice suffice vs consent theatre?
Labour-rules basis vs fake consent.
BasisWorking rule: Map the regulated role before marketing or launch in China.
The signal ledger.
These facts move the question beyond a label and into a product, money-flow and control analysis.
Bring a compact evidence docket—not a pitch deck.
Give a compliance team or counsel the operating facts that reveal the perimeter.
Questions people ask before they build.
Short answers for orientation. The right result can change with the service model and current rules.
Do we still need a privacy notice for staff?
Yes. A basis is not a substitute for informing people of processing.
Can we use employee consent for a new monitoring tool?
Usually a poor basis. Necessity under labour rules plus consultation/handbook process is the employment-law overlay.
Primary authorities
Reviewed sources support orientation, not a fact-specific assessment.