China has one of the most developed digital regulatory systems in the world, built on three laws (the Cybersecurity Law, Data Security Law and PIPL) and a growing body of CAC regulations on algorithms, deep synthesis, generative AI and labelling. The rules reach offshore companies that process data of people in China.
For most foreign startups, the first question is scope: are you serving users in China, processing their data, or launching AI services there? If so, plan for localisation, a transfer mechanism, a local representative and, for AI, filing and labelling.
- Data laws
- PIPL (2021), Data Security Law (2021), Cybersecurity Law
- Regulator
- Cyberspace Administration of China (CAC)
- Transfers
- Security assessment, standard contract or certification
- Generative AI
- Interim Measures (Aug 2023), algorithm filing
- Labelling
- AI content labelling measures from 1 Sep 2025
- Penalties
- Up to RMB 50 million or 5% of prior-year turnover (PIPL)
Who needs to comply
Companies processing personal information of people in China
PIPL applies within China and extraterritorially to processing for providing products or services to, or analysing, people in China.
Public-facing generative AI services in China
The Interim Measures, algorithm filing and security assessment rules apply.
Content platforms
Deep synthesis and labelling rules require labels and review duties for AI content.
Companies exporting data from China
Cross-border transfer mechanisms apply, with thresholds eased in 2024.
The laws, in detail
01Personal Information Protection Law (PIPL)
Personal information processing, consent, sensitive data, rights, transfers and offshore processors.
When it applies
Processing in China, or abroad for providing products/services to or analysing people in China.
What you must do
- Legal basis, often consent; separate consent for sensitive data and transfers
- Personal information protection impact assessments
- Local representative or entity for offshore processors
- Data subject rights and breach remediation
Regulator
CAC and sector regulators
Penalties
Up to RMB 50 million or 5% of prior-year turnover, plus business suspension.
02Cross-border data transfer rules
Mechanisms for exporting personal information and important data.
When it applies
Transferring personal information or important data out of China.
What you must do
- Security assessment, standard contract filing or certification depending on volume and sensitivity
- Exemptions for some contract performance and HR transfers since March 2024
Regulator
CAC
Penalties
Under PIPL and the Data Security Law.
03Data Security Law & Cybersecurity Law
Data classification, important data, network security and multi-level protection.
When it applies
Data processing activities and network operators in China.
What you must do
- Classify data and protect important data
- Multi-level protection scheme for networks
- Incident response and reporting
Regulator
CAC; Ministry of Public Security
Penalties
Fines and suspension.
04Generative AI, algorithm and labelling rules
Interim Measures for Generative AI Services, algorithm recommendation and deep synthesis rules, and AI content labelling measures.
When it applies
Providing generative AI or algorithmic services to the public in China; distributing AI content.
What you must do
- Algorithm filing and security assessment
- Lawful training data and content governance
- Explicit and implicit (metadata) labels on AI content
- User complaint mechanisms
Regulator
CAC
Penalties
Orders, suspension and fines under the underlying laws.
05Regulations on the Protection of Minors Online (2024)
Online protection of minors, including personal information of children.
When it applies
Online services used by minors in China.
What you must do
- Minor modes and time limits where required
- Separate rules for personal information of under-14s
- Compliance audits of minors’ data processing
Regulator
CAC and sector regulators
Penalties
Orders, fines and suspension.
Compliance checklist
01 · Decide scope
- Do you have users or data subjects in China?
- Will you launch AI services to the public in China?
- Do you export data from China?
02 · If in scope
- Local representative or entity
- PIPL consent and separate consents
- Transfer mechanism by volume and sensitivity
- Data localisation design
03 · For AI services
- Algorithm filing and security assessment
- Training data governance
- Labelling and metadata for AI content
- Local partner strategy
Key dates
- Jun 2017Cybersecurity Law
- Sep 2021Data Security Law
- 1 Nov 2021PIPL
- 15 Aug 2023Generative AI Interim Measures
- Mar 2024Cross-border data flow easing rules
- 1 Sep 2025AI content labelling measures
Common mistakes
- Assuming offshore hosting avoids PIPL
- Launching GenAI features without filing
- Using one global consent for China
FAQs
Can we serve Chinese users from abroad?
PIPL may still apply, requiring a local representative and compliant consent and transfers. AI services face additional rules.
Do we need a local partner for AI?
Often, in practice, because of filing, security assessment and content governance requirements. Take local advice.
In the law library
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.