In eleven days, on 1 November, China's Personal Information Protection Law takes effect. It was adopted on 20 August, seventy-three days' notice for the most consequential data law passed anywhere this year, and it arrives ten weeks after the Data Security Law came into force on 1 September. Most of the commentary calls it China's version of Europe's data protection regulation. The resemblance is real — lawful bases, data subject rights, impact assessments, a designated responsible person, penalties calculated against turnover — and it is also the reason so many organisations are about to misread the problem. Read as a privacy law, it looks like a documentation exercise. Read as what it also is — an instrument regulating the export of data from China — it becomes an architecture question, and the thing it breaks is not your privacy notice. It is your group systems.
Each event links to its supporting source. This is a selective chronology, not a performance comparison.
Four differences that decide what you have to do
Consent has to be separate. Bundling everything into one privacy notice with a single acceptance does not work. Specific, separately obtained consent is required for transferring personal information outside the country, for sensitive categories, for providing data to another party, and for automated decision-making. Every consent flow designed for a European framework will need to be rebuilt rather than translated. There are three routes for sending data out, and none of them can be used yet. Transfers require either a security assessment organised by the cyberspace regulator, certification by an accredited body, or a standard contract in a form the regulator will prescribe. As of today the assessment procedure is not finalised, no certification bodies are accredited, and the standard contract has not been published. Organisations are being asked to comply with a mechanism that does not yet exist, which is uncomfortable but is also a planning fact. Some data has to stay. Operators of critical information infrastructure and processors handling volumes above thresholds the regulator will set must store personal information in China, and may only transfer it out after passing the security assessment. The thresholds are unpublished. Assume they will catch more organisations than you expect. There is a blocking provision. Data stored in China may not be provided to a foreign judicial or law enforcement authority without approval from the competent Chinese authorities. For any multinational that could receive a foreign production order covering its Chinese subsidiary, that is a genuine legal conflict rather than a theoretical one, and it should be on the legal department's risk register before it appears in a live matter.
Your exposure is the shared system, not the data export
When executives hear cross-border transfer they picture a file being sent. The actual transfers are continuous and invisible, and they are almost all in the same place: the systems the group runs centrally. A single global instance of an enterprise resource planning system hosted in Singapore, Frankfurt or Virginia holds the personal data of your Chinese employees, your Chinese customer contacts and your Chinese suppliers' staff, and it transfers that data every time a record is written. The same is true of a global human resources platform, a shared customer relationship management tenant, a group service desk, an expense system, travel booking, email and chat. So is remote support: an administrator outside China accessing a system inside it is performing a transfer, and so is a managed service provider watching Chinese endpoints from a security operations centre elsewhere. Start there. Inventory which group systems hold personal information originating in China, who accesses them from where, and what would actually stop working if that data had to stay put. That inventory is the deliverable. Everything else follows from it.
Three realistic postures
For a small representative or sourcing office, with a handful of local employees and a supplier contact list, the proportionate answer is to keep Chinese personal data local — payroll and personnel records with a local provider — and to minimise ruthlessly what flows into group systems. Names in a group directory are usually unavoidable; performance files are not. For a sales and service presence, expect to localise the systems that hold customer personal data, and to feed the group aggregated or pseudonymised reporting rather than replicating records. Most global reporting needs numbers, not named individuals, and the organisations that discover this while redesigning for China usually find the same answer improves their position everywhere else. For a manufacturing or full operating presence, plan for a separate China stack and a Chinese entity that is a controller in its own right, with its own vendor contracts, its own retention rules and its own designated responsible person. That is expensive, and it is the shape the law is pushing toward. Whichever applies, do not sign anything irreversible while the implementing rules are unpublished. Build for the ability to change your mind in the second quarter of next year.
You may be in scope without a China entity
The law reaches processing carried out outside China where the purpose is to offer products or services to individuals in China, or to analyse their behaviour. A software company with Chinese subscribers, an online retailer shipping into the country, or a business running analytics on Chinese website visitors can be in scope with no presence at all, and such organisations are expected to establish a local representative and file the details with the authorities. If your revenue includes Chinese consumers, this is a question for this month rather than for next year's compliance plan.
Practical Guidance for PIPL Compliance Assessment
- Map which group systems hold personal data originating in China, including who accesses them from outside the country.
- Separate the consents for cross-border transfer, sensitive data, third-party provision and automated decisions.
- Complete and retain impact assessments for transfers and sensitive processing; the law expects them to be kept for three years.
- Appoint the responsible person and, if you are in scope from outside, a local representative, and file as required.
- Minimise what leaves, because the cheapest compliance measure available is holding less Chinese personal data in global platforms.
- Ask every vendor where Chinese data sits and whether they offer an isolated in-country option.
- Register the blocking provision as a legal conflict, with an agreed process for foreign production orders.
- Keep architectural choices reversible until the standard contract, certification scheme and thresholds are published.
The Regional Angle
Three consequences land specifically on Gulf groups, and the first is the one nobody has assigned an owner to. The typical regional group's China footprint is a sourcing or procurement office — a dozen people in Shenzhen, Guangzhou or Yiwu who inspect goods, chase suppliers and arrange shipments. Its personal data footprint looks trivial: a few employees and a few hundred supplier contacts. That combination is exactly why it is unmanaged. It is too small to have its own information technology function, so it runs on the group's systems in Dubai or on a regional cloud tenant, which means continuous export of Chinese personal information with no mechanism, no separate consent and no assessment. Nobody in the group has been made responsible for it because it has never been large enough to appear on a risk register. Eleven days from now it will be a compliance gap with a named local manager who is personally exposed under the statute. Fix the ownership question first; the technical remediation is comparatively easy. The second runs in the opposite direction and is becoming more important as Chinese technology deepens its presence in this region. Gulf organisations increasingly buy Chinese infrastructure, devices, platforms and managed services. The Data Security Law and this law together restrict what a Chinese vendor may export from China — which includes support data, diagnostic logs and telemetry relating to your systems. The practical questions to put to any Chinese supplier before renewal are specific: where does support data reside, what is exported to your regional support team, and during a serious incident affecting our systems, are you legally able to provide us with the logs we would need? A vendor that cannot answer clearly has introduced a constraint into your incident response that you did not know you had bought. The third is about how regional businesses actually operate in China, and it is unglamorous. A great deal of Gulf commercial activity there is conducted through personal relationships and messaging applications — supplier negotiations, order confirmations, quality photographs and shipping documents moving through a consumer messaging platform on someone's personal phone. That channel holds personal data of Chinese individuals, sits on Chinese infrastructure, is outside every policy you have written, and is frequently the only record of a commercial arrangement worth millions. The compliance exposure is real and secondary. The commercial exposure — that the record of your China supply relationships lives on the personal device of an employee who may resign next month — is the reason to fix it now, and the new law is a convenient pretext for a change that was overdue.
The objection worth taking seriously
The strongest objection is that this is disproportionate alarm. Enforcement attention in the first year will fall on large domestic platforms and consumer applications, not on a foreign mid-market group with a procurement office. The implementing rules are unpublished, so full compliance is literally impossible on 1 November. And building an isolated Chinese technology stack for twelve employees would cost more than the entire operation earns, which is not risk management but theatre. Every part of that is reasonable, and any adviser recommending a separate China stack for a representative office is selling a project rather than giving advice. But the exposure is misidentified. The headline penalties — up to fifty million yuan or five per cent of the previous year's turnover — are not the mechanism most likely to affect you. The operational sanctions are: suspension of business activities, removal of applications, entries in the corporate credit record that affect licences and tenders, and personal liability for the individual designated as responsible, who is usually your local general manager. Those consequences do not require a landmark case. They arrive through routine supervision, and they stop an operation rather than fining it. The incompleteness objection also cuts the other way. Precisely because the mechanisms are unfinished, the work available now is the work that will still be correct whatever the rules say: knowing which systems hold Chinese personal data, reducing how much of it sits in global platforms, obtaining consent properly, documenting assessments, and naming an accountable person. None of that is wasted if the standard contract published next year is more permissive than feared. All of it is urgent if it is not.
Common Questions
We only have a small office in China. Are we in scope?
Yes. There is no small-entity exemption, and a small office typically runs on group systems, which is where the transfers happen.
Can we rely on employee consent to keep using our global systems?
Partly, and not comfortably. Consent must be separate and informed, and consent obtained from employees by an employer is treated cautiously under most modern regimes. Treat it as one element alongside minimisation and a transfer mechanism, not as the whole answer.
Should we wait for the standard contract to be published?
Wait before signing anything structural; do not wait to build the inventory, fix consent flows or reduce what your global systems hold.
What should we expect over the next twelve months?
Expect the implementing measures — the security assessment procedure, the standard contract form, the certification scheme and the volume thresholds — to emerge in stages through next year, with short compliance windows attached. Expect early enforcement to target consumer applications and cross-border flows in sensitive sectors rather than industrial groups. Expect the major cloud and software vendors to announce isolated China options and to charge for them. Expect this structure — localisation by default, export by permission — to be copied, including by regulators in this region now drafting implementing rules for their own new laws. And expect the organisations that spend the next six months reducing how much personal data their global platforms hold to find that decision paying off in three separate jurisdictions.
PIPL Compliance Assessment — we map where Chinese personal data actually sits in your group systems, size the realistic posture for your presence, and sequence the work so the architecture stays reversible until the rules are final.