China

Personal Information Protection Law, article 3 (extraterritorial reach) and article 53 (dedicated entity or designated representative, whose details must be reported to the regulator). The obligation bites again at the transfer stage: under the Personal Information Outbound Certification Measures, article 7, an overseas processor cannot even apply for a certificate on its own — a domestic entity or designated representative has to file for it. Separately, any processor holding personal information on more than one million people must file the name and contact details of its personal information protection officer with the municipal cyberspace office; the regulator opened an online filing system for this in July 2025 and set 29 August 2025 as the deadline for those already over the line.

The volume ladder is set by the Provisions on Promoting and Regulating Cross-Border Data Flows, in force 22 March 2024. Government security review is required where a critical information infrastructure operator sends any personal information abroad, where anyone sends 'important data' abroad, or where a non-critical operator has cumulatively sent the ordinary personal information of more than one million people, or the sensitive personal information of more than 10,000 people, since 1 January of the current year. Between 100,000 and one million people (or under 10,000 sensitive), the standard contract or certification route applies. Under 100,000 people of ordinary personal information, no mechanism is needed. Free trade zones add a further carve-out: nine or more zones have published 'negative lists', and data not on the local list needs no mechanism at all — as of March 2026 the regulator said the lists cover 22 fields including cars, retail, civil aviation, reinsurance, deep-sea industry, seed breeding, geographic information and meteorology, and enterprise credit information. SECTOR OVERRIDES, each rated separately: critical information infrastructure (mirror); non-bank payments (mirror — systems and backups must sit in China); credit reporting (mirror); health and medical big data (mirror); human genetic resource information (case-by-case, with a security review above 500 sequenced genomes); internet map services (closed — map data servers must be in China); telecom, industrial and radio data (mirror where a law imposes storage, plus a ban on handing data to foreign industry regulators without ministry approval); overseas securities listings (audit working papers stay in China); banks and insurers (conditional — there is no absolute storage wall in the banking and insurance rules, contrary to common belief); government e-government systems (approval-gated outsourcing).

Personal Information Protection Law article 38 sets the three mechanisms; article 39 requires notice of the overseas recipient plus separate consent. The controlling instrument is the Provisions on Promoting and Regulating Cross-Border Data Flows (22 March 2024). There is no destination blocklist and no adequacy allowlist: China regulates the exporter, not the country of arrival. The regulator's April 2025 policy Q&A confirmed the security assessment result is now valid for three years rather than two, that an extension can be requested 60 working days before expiry, and that a corporate group may file one application covering several subsidiaries. The certification route was completed by the Personal Information Outbound Certification Measures (Cyberspace Administration and market regulator joint order no. 20, published 17 October 2025, in force 1 January 2026): certificates last three years, only non-critical-infrastructure processors in the 100,000-to-one-million band may use it, and an overseas applicant must apply through a domestic entity or designated representative. The supporting national standard GB/T 46068-2025 took effect on 1 March 2026.

Observable evidence gathered on 18 August 2026: the internet regulator, industry ministry and Ministry of Public Security jointly announced the 2026 personal information protection campaigns on 2 April 2026, covering apps and software kits, internet advertising, education, transport, healthcare, finance, and criminal rings trading personal data, promising to deal severely with serious cases and refusals to rectify. Named-and-shamed app batches followed on 27 April 2026 (33 apps) and 11 June 2026 (30 apps). On 16 September 2025 the regulator published ten worked enforcement cases covering unpatched vulnerabilities, weak passwords, leaked databases, excessive collection, unlawful biometric collection and a deep-synthesis service launched without its required security review; outcomes were warnings, rectification orders, fines and one app removal. Provincial internet offices do the front-line work on data export filings, and eight more provinces were added as pre-assessment pilot sites during 2026. Rated active rather than aggressive: volume is high and the regulator clearly goes looking, but published penalty values are small and headline-scale fines remain rare.

Floor: Cybersecurity Law article 23 (as renumbered by the amendment in force 1 January 2026) requires technical measures to monitor and record network operation and security events and to retain relevant network logs for not less than six months. The Accounting Archives Management Measures (Ministry of Finance and National Archives Administration order no. 79, in force 1 January 2016) set minimum retention periods by schedule and state expressly that those periods are minimums; article 25 requires compliance with national rules before accounting archives are carried or transmitted out of China. Ceiling: Personal Information Protection Law article 19 caps retention at the shortest time necessary to achieve the processing purpose unless another law says otherwise, and article 47 requires deletion when the purpose is achieved or can no longer be achieved, the service is terminated, the retention period expires, or consent is withdrawn — where deletion is technically impracticable the processor must stop all processing except storage and security. Conflict resolution is the standard 'unless laws or administrative regulations provide otherwise' carve-out in article 19.

The National Cybersecurity Incident Reporting Measures took effect on 1 November 2025. Article 4 sets the clocks: critical information infrastructure operators report to the protecting department and public security at once and no later than one hour; central and state organs report within two hours through their own cybersecurity office; everyone else reports to the provincial cyberspace office within four hours. Article 7 requires follow-up reports as the investigation develops, and article 11 offers leniency where the operator had reasonable protections in place, followed its incident plan and reported on time — a genuine incentive to report early. The 24-hour clock sits in the Network Data Security Management Regulation (State Council order no. 790, in force 1 January 2025), which also requires immediate activation of the incident plan and direct notification of affected individuals. Personal Information Protection Law article 57 adds an immediate duty to notify both the regulator and the individuals whenever personal data is leaked, altered or lost, or may have been. Banks and insurers report to their own regulator in parallel.

(1) Personal Information Protection Law article 39. (2) Article 28 makes information on minors under 14 sensitive personal information; article 31 requires guardian consent plus dedicated processing rules. Note this is lower than India's under-18 and different again from Europe's 13-to-16 range. (3) Data Security Law article 36 and Personal Information Protection Law article 41 both prohibit providing data stored in China to foreign judicial or law enforcement bodies without approval from the competent Chinese authority; Data Security Law article 48 sets fines of 100,000 to one million yuan (about $14,000 to $140,000), rising to one to five million yuan (about $140,000 to $700,000) with suspension or licence revocation in serious cases. The industry ministry has its own version: industrial, telecom and radio data stored in China may not be given to foreign industry, telecom or radio enforcement agencies without ministry approval. (4) 'Important data' triggers the heaviest gate — a full government security review — but identification is largely self-assessed against national standard GB/T 43697-2024 and regional and sector catalogues that are still being published; the regulator's October 2025 Q&A confirmed the two-month window for reporting newly identified important data cannot be extended. (5) We could find no domestic storage requirement for personal financial information in the People's Bank of China's Financial Consumer Rights Protection Measures (in force 1 November 2020). The belief traces to a 2011 central bank notice and to a recommended, non-mandatory industry standard; the binding walls we could verify are for non-bank payment institutions and credit reporting agencies, not for banks generally. Bonus trap: hold data on more than one million people and you must file your privacy officer with the regulator; hold data on more than ten million and you must run a compliance audit at least every two years.

In the pipeline, none of it binding today: draft Provisions on Personal Information Protection by Large Personal Information Processors, published for comment 7 August 2026, comment window to 7 September 2026, with the ten-million-person trigger and an express domestic storage duty; draft Simplified Personal Information Protection Measures for Small Processors, 3 April 2026; draft Provisions on Personal Information Collection and Use by Internet Applications, 10 January 2026; draft Provisions on Personal Information Protection by Large Network Platforms, 22 November 2025. Already landed and now biting: the amended Cybersecurity Law from 1 January 2026, which raises the top fine to ten million yuan (about $1.4 million) and adds an artificial intelligence article; the certification route from 1 January 2026 with its national standard from 1 March 2026. DORMANT SWITCHES, which matter more than the drafts: the government can designate you a critical information infrastructure operator at any time, which instantly converts you from 'paperwork' to 'the data stays'; regional and sector 'important data' catalogues are still being issued and each one can pull a new dataset into the security-review gate; free trade zone negative lists are revised zone by zone and can grow as easily as shrink; and a security assessment approval is limited to the exact purpose, scope, method and categories declared, so a product change can silently void it.