PIPL · 01
PIPL scope & duties
PIPL attaches to processing facts. Labels such as ‘group HR system’ do not decide handler status or a transfer path.
First job Identify what is processed, who is the handler and which PIPL duties actually attach.
Start here
Key considerations
- What personal information is processed in or from China?
- Who decides purposes and means?
- Is an overseas recipient already in the design?
Decision map
Keep the question bounded.
- Map the processingCategories, systems and locations — at a high level.
- Name the handlerChina entity versus overseas controller assumptions.
- Split exportCross-border questions belong on the transfer route.
Curated resources
Open the asset that matches this job.
China data compliance decision guide
National PIPL, transfer and cybersecurity decision desk — not a substitute for a filing pack.
PIPL key rules
What counts as personal information and the core handler duties.
PIPL compliance checklist
A structured prompt for processing, vendors and transfer evidence.
Helpful to prepare
Facts that make the next conversation clearer.
These items are orientation aids, not a legal requirement list.
- Processing inventory in non-confidential terms
- China entity and overseas affiliates involved
- Whether employee, customer or device data is in scope
Local context
Add the city when regulator practice changes.
CAC and industry-regulator practice can differ after the national transfer or cybersecurity question is identified.
Open city and province guidesCounsel hand-off
Need data-privacy counsel?
This hub organises PIPL, cybersecurity and export questions. It does not decide whether a transfer is lawful or whether notice is required on your facts.
Find data-privacy counsel