Privacy Representation
China PIPL Representative
Article 53 of the Personal Information Protection Law requires organisations outside China that process the personal information of people in China to appoint a local representative.
China has not yet started enforcing that requirement, so the service is not live. Register your interest and we will tell you the moment it opens.
:quality(80):fill(transparent)){kind=spacer}
Be first in line for China PIPL Representation
This service is not live yet. Registering costs nothing and commits you to nothing — it puts you at the front of the queue for the day China starts enforcing the representative requirement.
-
Now
You register your interest
Leave your email and the size of your organisation. No payment, no contract, no obligation.
-
Next
We wait for enforcement
Article 53 is already law, but China has not yet operationalised the filing and enforcement of the representative requirement. We build the service out as that lands.
-
At launch
You hear first
Everyone who registered is contacted before the service goes public, with onboarding and pricing. We cannot promise a date — that depends on the Chinese authorities, not on us.
Register your interest
We use your address only to tell you about this service. No newsletter, and you can ask us to delete it at any time.
What a China PIPL Representative does
The PIPL applies beyond China's borders. If you offer products or services to people in China, or analyse their behaviour, you fall in scope even with no entity in the country.
Appoint a representative established in China and file their name and contact details with the authorities.
Give data subjects in China a local point of contact for their rights requests.
Be reachable by the Cyberspace Administration of China through that representative.
Face fines of up to 50 million RMB or 5% of annual turnover for non-compliance.
As with our other representation services, we would carry the local presence, handle the filing and take the inbound contact, so your team deals with one dashboard instead of a Chinese intermediary.
The Prighter One-Stop Shop
Security, data protection, and AI and Digital Governance are very closely interconnected and share similar concepts and requirements. With Prighter and our global network of partners you can cover the full digital regulatory landscape with a single provider — ensuring consistency and cost-effectiveness.
Bespoke Service
We can provide you with legal, technical, and security related services in addition to our core products. Rely on the experience and knowledge of our experts to guide you through the constantly evolving framework for digital services.
Resource Center
We provide your in-house team with full access to our resources — knowledge, documentation, and guidelines — to support your compliance efforts. Leverage the proven foundation we've built for clients and tailor it to your specific needs.
Rely on Our Experts
Our team stands beside yours as a trusted and reliable partner. We are there for your individual needs and can help you setup and maintain your tailored security program fitting. Compliance products with a human touch
In the meantime, we already cover a lot of the map
China is not live yet, but your obligations elsewhere are. These services run today, from one dashboard and one contract.
:quality(80):fill(transparent))
:quality(80):fill(transparent))
:quality(80):fill(transparent))
:quality(80):fill(transparent))
:quality(80):fill(transparent))
:quality(80):fill(transparent))
China's Personal Information Protection Law (PIPL) FAQ
Is the PIPL applicable to my company?
The extra-territorial scope of the PIPL is very similar to the GDPR. According to Art. 3 PIPL, the Chinese data protection law applies to your company if you:
- offer services or products to people inside the Chinese borders;
- analyse and assess activities of people inside Chinese borders; and
- do so under other circumstances provided in laws or administrative regulations. So far, no such additional laws or regulations have been published.
Does your company offer services or products according to Art. 3 §2 PIPL?
So far, there are no guidelines published by Chinese authorities on the question of when a company offers services or products in China. However, the wording is nearly identical to the wording of GDPR. Assuming that the purpose of regulating the extra-territorial scope of PIPL is similar to that of GDPR, and if it takes the same approach as GDPR does, it gives a first indication of what the offering means from the guideline on the territorial scope of the GDPR by the EDPB (Guideline 3/2018). However, it is expected that the Chinese authorities will publish their own guidelines, which, hopefully, will bring more clarity and certainty. Until then, factors that may be considered to result in an “offering of goods or services” to individuals in China could be:
- using languages used in China and offering payments in Chinese Yuan;
- using ads to address Chinese individuals or other marketing tools directed towards Chinese customers;
- mentioning addresses or phone numbers to be reached from China;
- using top-level Chinese domains;
- offering delivery of goods to China.
Does your company analyse and assess the activities of individuals inside of China?
So far, there is no material from Chinese officials on the interpretation of the criteria “analyse and assess the activities of individuals”. However, the following activities are likely to trigger the applicability of Chinese PIPL:
- behavioural advertisement
- geo-localisation activities
- online tracking by using cookies or other tracking technologies
- market surveys and other behavioural studies based on individual profiles
- CCTV
What fine may be imposed for non-compliance?
PIPL has hefty penalties in place for breaches of data protection laws. Penalties can reach up to RMB 50 million (€ 6.6 million) or 5% of the previous year's turnover. It is not yet clear whether the turnover is calculated based on the revenue from the Chinese market or the global business activities. Personal fines of up to RMB 1 million can also be imposed on 'directly responsible persons'. The data protection authorities can order other authorities to revoke administrative and business licences. It is to be expected that the Chinese authorities will take tough action here. For example, companies operating app stores were ordered to remove the app of Uber-competitor Didi Chuxing from their stores due to alleged data protection violations. When companies infringe the privacy rights of many individuals, prosecutors, statutorily designated consumer organisations, and organisations designated by the State for cybersecurity may file a lawsuit with the competent Chinese Court. This way, the State can take action against companies on behalf of affected individuals. Of course, it is also possible for individuals to file their own lawsuits for damages against a company.