China Inbound Legal Guides · Data Privacy & Cybersecurity
China legal decision desk
Data Privacy
& Cybersecurity
PIPL and data-security duties follow activity, classification, then a filing or localisation route. Map the flow before the vendor contract.
gates mapped before the next move
DATA PRIVACY & CYBERSECURITY
PIPL SCOPE & DUTIES · CYBERSECURITY & MLPS · CROSS-BORDER TRANSFERS · EXEMPTIONS & THRESHOLDS · INCIDENTS & NOTIFICATION
An export filing, system go-live or incident-notice window can change the next action. This is a compliance clock, not a family-safety route.
Open transfer gatesDecision desk / 01
Where is the
pressure point?
Matter statusCLASSIFY FIRSTConfirm the current route
PIPL scope & duties
Identify what is processed, who is the handler and which PIPL duties actually attach.
Open routeCybersecurity & MLPS
Separate cybersecurity grading from personal-information export questions.
Open routeCross-border transfers
Name the transfer route before promising a system architecture or a date.
Open routeExemptions & thresholds
Test whether an exemption or threshold actually applies before choosing a filing path.
Open routeIncidents & notification
Contain and record before treating the event as a general PIPL essay.
Open routeSituation-based routes
Start where
the matter is.
8 bounded routes turn a broad concern into the next useful question.
PIPL scope & duties
Personal information, handlers, notices, consent and the core processing duties.
Open route 02CybersecurityCybersecurity & MLPS
Network-security duties and multi-level protection as a separate file from PIPL transfers.
Open route 03TransfersCross-border transfers
Export paths, CAC filings, standard contracts and certification — the gate that holds go-live.
Open route 04ExemptionsExemptions & thresholds
Volume, necessity and published exemption tests that can change which export mechanism applies.
Open route 05IncidentIncidents & notification
Breach, leakage and the clock for containment, notice and evidence.
Open route 06EvidenceProgramme & evidence
Records, DPIA-style notes, vendor maps and the file you would show a regulator or counsel.
Open route 07Advanced PIPL processingAdvanced PIPL processing
Joint processing, automated decisions and employee data under PIPL.
Open route 08Digital platforms & data complianceDigital platforms & data compliance
Platform data governance, PIPL/Data Security Law duties and interfaces with e-commerce operations.
Open routeDecision shortcuts
Already know
the issue?
Jump to the narrow question changing your next move.
Editorial & legal review
Research with
professional boundaries.
Route logic and substantive content require review when current rules change.
No lawyer is presented as the legal reviewer until an appropriately qualified specialist is assigned.
This hub routes research; it does not provide legal advice or promise regulatory clearance.
Editorial policyCounsel hand-off
Need data-privacy counsel?
This hub organises PIPL, cybersecurity and export questions. It does not decide whether a transfer is lawful or whether notice is required on your facts.