China PIPL

Personal Information Protection Law: cross-border data transfer, processor inventory, security measures.


Short name	PIPL
Region	Asia-Pacific
Country or scope	China
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers PIPL

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 12 controls from Safeguard's control catalog for PIPL.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for PIPL and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`CN-PIPL-51` Security Measures for Processing	Personal information handlers must adopt corresponding technical security measures such as encryption and take steps to prevent unauthorised access, leakage, tampering or loss, which includes verifying the integrity of processing software (PIPL Art. 51)	Scan
`CN-PIPL-51INV` Classified Processing Inventory	Handlers must formulate internal management systems and operating procedures and implement categorised management of personal information, requiring an inventory of the software components involved in processing (PIPL Art. 51(1)-(2))	Scan
`CN-PIPL-21` Entrusted Party Supervision	Where processing is entrusted to another party, the handler must agree on purpose and method and supervise the entrusted party's processing, requiring knowledge of who supplies each processing component (PIPL Art. 21)	Scan
`CN-PIPL-55` Impact Assessment Documentation	Personal information protection impact assessments must be conducted for high-risk processing and the reports retained for at least three years, requiring identifiable, timestamped system documentation (PIPL Arts. 55-56)	Scan
`CN-PIPL-57` Incident Notification Readiness	On a leak, tampering or loss of personal information, handlers must immediately take remedial measures and notify authorities and individuals, which depends on rapidly identifying affected components and versions (PIPL Art. 57)	Scan
`CN-PIPL-38` Cross-Border Chain Traceability	Cross-border provision of personal information requires security assessments and contractual controls, which presuppose that the software chain handling the data is identifiable end to end (PIPL Arts. 38-40)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`PIPL-A13`	Establish a Lawful Basis for Processing Personal Information
`PIPL-A17`	Provide Individuals with a Clear Privacy Notice
`PIPL-A21`	Govern Third-Party Entrusted Processing by Contract
`PIPL-A23`	Obtain Separate Consent for Third-Party Provision
`PIPL-A28`	Apply Strict Controls to Sensitive Personal Information
`PIPL-A38`	Satisfy Legal Conditions for Cross-Border Transfers
`PIPL-A40`	Obtain Separate Consent for Overseas Transfers
`PIPL-A44`	Fulfil Individual Rights Requests
`PIPL-A51`	Implement PI Protection Measures Proportionate to Risk
`PIPL-A55`	Conduct Personal Information Protection Impact Assessments
`PIPL-A58`	Comply with Large Platform Obligations
`PIPL-BREACH`	Notify Regulators and Individuals of PI Incidents

Policy templates

Written for PIPL:

Cross-Border Personal Information Transfer Policy (PIPL)
Personal Information Consent and Data Subject Rights Policy (PIPL)
Important Internet Platform Obligations Policy (PIPL Article 58)

And 22 from the standard set, adapted to PIPL.