ہوم › قوانین کی لائبریری › PIPL
PIPL
Personal Information Protection Law of the People's Republic of China
ذرائع کے ساتھ · 13/14 حقائق کی دو ذرائع سے تصدیق ہوئی. آخری تصدیق 10 اکتوبر، 2026
اگلی مکمل جانچ: . ریگولیٹرز کی خبریں ہر ماہ دیکھی جاتی ہیں؛ تبدیلیاں درج ہوتی ہیں: تبدیلیوں کا ریکارڈ.
اس صفحے کا حوالہ دیں: GlanceDesk Jurisdiction, “PIPL (China)”, glancedeskjurisdiction.com/laws/cn-pipl, last verified 10 October 2026.
China پرائیویسی
- حیثیت
- In force since 1 Nov 2021. Key implementing rules: cross-border data flow provisions (22 Mar 2024), network data security regulations (1 Jan 2025), compliance audit measures (1 May 2025), certification measures (1 Jan 2026).✓
- یہ کن پر لاگو ہوتا ہے
- Processing in mainland China, plus processing abroad of data of people in China to offer them products or services, or to analyse or evaluate their behaviour. Covers private and public sectors.✓
- سائز کی حدیں
- No size threshold. Volume thresholds trigger extra duties: protection officer above 1 million individuals; mandatory audit every 2 years above 10 million; transfer mechanism tiers at 100,000 / 1 million (sensitive: 10,000).✓
- ریگولیٹر
- Cyberspace Administration of China (CAC), with the Ministry of Public Security, MIIT, SAMR and sector regulators✓
- خلاف ورزی یا واقعے کی رپورٹنگ
- PIPL: act immediately and notify regulators and affected people (individual notice can be skipped if harm is effectively avoided, unless regulators order it). National Cybersecurity Incident Reporting Measures (from 1 Nov 2025), for incidents graded 'relatively major' or above: critical information infrastructure operators within 1 hour (to the CII protection department and public security), state organs within 2 hours (to their CAC office), other network operators within 4 hours (to the provincial CAC); summary report within 30 days after the incident is closed.
- ذاتی ڈیٹا کی درخواستوں کے جواب کی آخری تاریخ
- PIPL sets no fixed number of days: requests (access, copy, correct, delete, portability, explanation) must be handled in a timely manner, with reasons given for refusals.✓
- ڈیٹا پروٹیکشن آفیسر
- Appoint a personal information protection officer if processing data of more than 1 million individuals; publish contact details and file them with the regulator.✓
- مقامی نمائندہ
- Overseas processors caught by the extraterritorial rule must set up a dedicated office or appoint a representative in China and file their details with the regulator (Art. 53).✓
- ڈیٹا بیرونِ ملک بھیجنا
- Needs separate consent plus one route: CAC security assessment (CIIOs, important data, or >1m people / >10,000 sensitive since 1 Jan), or standard contract filing or certification (100,000-1m people / <10,000 sensitive). Exempt: <100,000 non-sensitive, contracts, HR, emergencies.✓
- کوکیز اور رضامندی
- Consent is the main legal basis and must be informed and voluntary. Separate consent is needed for sensitive data, overseas transfers, sharing with another controller, and public disclosure.✓
- زیادہ سے زیادہ سزا
- Serious violations: up to RMB 50 million or 5% of the previous year's turnover, plus business suspension or licence revocation; responsible managers fined RMB 100,000-1 million and may be barred from senior roles.✓
جن حقائق پر “تصدیق جاری ہے” لکھا ہے ان کی ابھی تصدیق ہو رہی ہے اور انہیں جواب کے طور پر نہیں دیا جاتا۔
آپ کو کیا کرنا ہوگا✓
- Get consent (separate consent for sensitive data, sharing and overseas transfers) after a full notice
- Run a personal information impact assessment before sensitive, automated-decision or cross-border processing
- Pick the correct transfer route (assessment, standard contract or certification) based on yearly volumes
- Appoint a protection officer above 1 million individuals and file the contact details
- Audit compliance at least every 2 years if processing data of more than 10 million people
- Appoint a China representative if you serve Chinese users from abroad
- Contain incidents immediately and report to the CAC and affected people
حالیہ تبدیلیاں
2024: cross-border rules eased (exemptions for under 100,000 people, contracts, HR). 2025: network data regulations (1 Jan) and mandatory compliance audits (1 May). 1 Nov 2025: incident reporting measures. 1 Jan 2026: amended Cybersecurity Law in force (higher penalties, wider extraterritorial reach); CAC/SAMR measures formalise the certification route for outbound transfers (already in PIPL Art 38).✓
ذرائع
- بنیادی ذریعہ: http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559_3.htm
- دوسرا ذریعہ: https://www.dlapiperdataprotection.com/index.html?t=law&c=CN
- ریگولیٹر: Cyberspace Administration of China (CAC), with the Ministry of Public Security, MIIT, SAMR and sector regulators
آزادانہ جانچ کے لیے استعمال ہونے والے ذرائع (13)
- https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm
- https://www.gov.cn/zhengce/zhengceku/202409/content_6977767.htm
- https://www.cac.gov.cn/2025-02/14/c_1741233507681519.htm
- https://www.cac.gov.cn/2025-10/17/c_1762449728518762.htm
- https://www.dlapiperdataprotection.com/index.html?t=law&c=CN
- http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559.htm
- http://en.npc.gov.cn.cdurl.cn/2021-12/29/c_694559_3.htm
- https://www.cac.gov.cn/2025-09/15/c_1759583017717009.htm
- https://www.lw.com/en/insights/2025/10/china-cac-announces-new-cybersecurity-incident-reporting-measures
- https://www.hsfkramer.com/notes/data/2025-posts/china-releases-final-measures-on-cybersecurity-incident-reporting
- https://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html
- https://www.lw.com/en/insights/chinas-cybersecurity-law-amendments-increase-penalties-broaden-extraterritorial-enforcement
- https://www.arnoldporter.com/en/perspectives/advisories/2025/11/china-requirements-personal-information-protection-certification
= دو آزاد ذرائع سے تصدیق شدہ، جن میں کم از کم ایک سرکاری ہے۔ ہم تصدیق کیسے کرتے ہیں
صرف معلومات، قانونی مشورہ نہیں۔ قوانین بدلتے رہتے ہیں؛ اس صفحے پر انحصار کرنے سے پہلے ریگولیٹر یا کسی مستند وکیل سے تصدیق کریں۔ کوئی غلطی نظر آئی؟ ای میل کریں contact@