China PIPL / Cybersecurity Law / MLPS

Introduction: China's Data and Cyber Trinity

China governs data and cybersecurity through a tightly interlocked trinity of national laws: the Cybersecurity Law (CSL, effective 1 June 2017), the Data Security Law (DSL, effective 1 September 2021) and the Personal Information Protection Law (PIPL, effective 1 November 2021). Sitting beneath these statutes is the Multi-Level Protection Scheme (MLPS 2.0), the mandatory technical grading and certification regime for network operators codified in GB/T 22239-2019. Together these instruments create one of the most demanding, extraterritorial and enforcement-active data governance environments in the world. For any organisation that markets to, processes the data of, or operates infrastructure serving individuals in the People's Republic of China, compliance is not optional and the penalties are severe.

This guide is written for two audiences at once: the auditor or assessor who must test conformity and gather evidence, and the CISO, DPO or China-market implementer who must build and operate the control environment. It maps the specific obligations, thresholds, filing deadlines, control families and lifecycle requirements unique to the CSL/DSL/PIPL/MLPS stack. Article numbers, grading levels and regulatory bodies are cited to the operative Chinese-language instruments; all explanatory text is original and no copyrighted statutory text is reproduced.

What is China PIPL/CSL

The framework is a layered regulatory system rather than a single act. Each layer addresses a distinct object of protection and is enforced by overlapping regulators.

The Cybersecurity Law (CSL)

The CSL is the foundational statute establishing network security obligations for all 'network operators' and heightened duties for operators of Critical Information Infrastructure (CII). It introduces MLPS as a legal mandate (Article 21), CII protection (Articles 31-39), data localisation for CII (Article 37), real-name registration, network product and service security review, and incident response and reporting duties. Enforcement sits primarily with the Ministry of Public Security (MPS) and the Cyberspace Administration of China (CAC).

The Data Security Law (DSL)

The DSL governs all data processing activities (not just personal data) and introduces a national data classification and hierarchical protection system, distinguishing ordinary data, 'important data' and 'core data' (national security relevant). It imposes risk assessment, incident reporting, and a controversial blocking provision (Article 36) prohibiting the transfer of data stored in China to foreign judicial or enforcement authorities without Chinese approval.

The Personal Information Protection Law (PIPL)

PIPL is China's comprehensive personal data statute, frequently compared to the EU GDPR but stricter in several respects. It defines lawful bases for processing (consent-centric, no legitimate-interest ground), sensitive personal information, individual rights, cross-border transfer mechanisms (Articles 38-43), separate consent requirements, and extraterritorial reach (Article 3). It appoints CAC as lead regulator and imposes fines up to RMB 50 million or 5% of prior-year turnover.

The Multi-Level Protection Scheme (MLPS 2.0)

MLPS is the technical certification backbone. Every network/system must be self-graded from Level 1 to Level 5 based on the harm its compromise would cause to citizens, legal persons, social order or national security. Grade 2 and above require filing with the local Public Security Bureau (PSB) and, for Grade 3+, periodic expert testing (dengbao) by an accredited assessment organisation.

Who Must Comply / Scope of Applicability

Scope is broad and expressly extraterritorial. The following table summarises who is captured and under which instrument.

• Data localisation is mandatory for CII operators and for PI handlers reaching CAC volume thresholds; other data may in principle leave China only via an approved transfer mechanism.
• There is no small-business blanket exemption; SMEs processing China PI are in scope, though audit and DPO thresholds scale with volume.
• State organs and public bodies have a dedicated PIPL chapter (Chapter 2, Section 3) with additional constraints.

Structure of China PIPL/CSL

The framework can be decomposed into statutory pillars, each with its operative article ranges and implementing rules. The table below is the structural map an assessor uses to build a coverage matrix.

Master Assessment Checklist

This is the operative core of the guide. Each control group below carries a table of what the auditor must verify and the typical evidence that proves conformity. No control area is skipped; groups follow the statutory pillars above.

Group 1 — MLPS Grading and Filing (CSL Art 21)

Group 2 — MLPS Technical Controls (GB/T 22239-2019, secure computing environment)

Group 3 — MLPS Management Controls (GB/T 22239-2019, management dimension)

Group 4 — Critical Information Infrastructure (CSL Arts 31-39)

Group 5 — Data Classification and Security (DSL Arts 21-30)

Group 6 — Lawful Basis and Processing Principles (PIPL Arts 5-13)

Group 7 — Notice and Consent (PIPL Arts 14-18)

Group 8 — Sensitive Personal Information (PIPL Arts 28-32)

Group 9 — Automated Decision-Making (PIPL Art 24)

Group 10 — Individual Rights (PIPL Arts 44-50)

Group 11 — Cross-Border Data Transfer (PIPL Arts 38-43)

Group 12 — Entrusted Processing and Sharing (PIPL Arts 20-23)

Group 13 — Governance, DPO and Compliance Audit (PIPL Arts 51-54)

Group 14 — PIPIA / Impact Assessment (PIPL Art 55-56)

Group 15 — Breach and Incident Response (CSL Art 25; DSL Art 29; PIPL Art 57)

Group 16 — Algorithm and Generative AI Governance

Scoping and Materiality / Tiering

Effort must be proportioned to the harm potential and data sensitivity. The framework provides several native tiering axes that drive scope.

• MLPS grade (1-5): the higher the grade, the more control objectives, the mandatory security management centre (Grade 3+) and more frequent dengbao testing.
• DSL data tier (ordinary / important / core): 'core data' attracts the strictest controls and is largely un-exportable; 'important data' triggers risk assessment and possible CAC security assessment for transfer.
• PI volume thresholds: CAC volume bands (e.g. handling PI of large numbers of individuals, or cumulative export volumes) trigger DPO appointment, security assessment for export, and mandatory compliance audits.
• CII designation: being named a CII operator escalates every obligation, adds localisation and procurement security review.
• Sensitive PI presence: any sensitive-PI processing raises the assessment to PIPIA-mandatory and separate-consent-mandatory.

Implementation Approach

A phased programme lets organisations reach defensible compliance while sequencing filings and testing windows correctly.

Phase 1 — Discovery and Grading (Weeks 1-4)

• Activities: system inventory, data mapping, MLPS self-grading per GB/T 22240, DSL data classification, applicability analysis (CII, extraterritorial, thresholds).
• Deliverables: system register with MLPS grades, data catalogue with tiers, applicability memo, gap-analysis baseline.

Phase 2 — Filing and Legal Foundations (Weeks 3-8)

• Activities: PSB filing for Grade 2+ systems, appoint DPO and (if extraterritorial) local representative, draft PIPL notices and consent flows, establish RoPA.
• Deliverables: PSB filing certificates, appointment records, published privacy notices, consent architecture, records of processing.

Phase 3 — Control Build and Remediation (Weeks 6-16)

• Activities: implement MLPS technical/management controls, deploy SM cryptography, build security management centre (Grade 3+), stand up incident response, deploy rights-fulfilment workflows.
• Deliverables: hardened control environment, IR plan and drills, DSAR/rights portal, encryption and access-control evidence.

Phase 4 — Assessments and Transfers (Weeks 12-20)

• Activities: conduct PIPIAs, select and execute cross-border transfer mechanism (CAC assessment / SCC filing / certification), commission dengbao testing for Grade 3+.
• Deliverables: PIPIA reports, filed Standard Contract or CAC approval, dengbao test report and remediation log.

Phase 5 — Sustain and Improve (Ongoing)

• Activities: annual compliance audit, annual CII assessment, re-grading on change, algorithm/AI filings, continuous monitoring and metric reporting.
• Deliverables: annual audit report, updated filings, KPI dashboard, management review minutes.

Maturity / Tiering Model

Beyond the statutory MLPS grades, organisations should track programme maturity to prioritise investment. The model below combines an operational maturity ladder with the corresponding MLPS/DSL posture.

Assessment and Audit Approach

1. Confirm applicability: establish which instruments bind the entity (network operator, CII, extraterritorial PIPL, important-data handler) and record the legal basis for scope.
2. Verify grading and classification: test MLPS grades against GB/T 22240 and DSL tiers against sector catalogues; challenge any under-grading.
3. Validate filings: confirm PSB beian for Grade 2+, DPO/representative appointments and CAC transfer filings exist and are current.
4. Test technical controls: sample MLPS baseline controls per grade, verify SM cryptography, access control, logging and the security management centre where required.
5. Examine PI processing: trace lawful basis, notice, consent (including separate consent), minimisation and retention across representative data flows.
6. Assess transfers: verify the transfer mechanism, PIPIA and consent for each cross-border flow; confirm no unlawful data provision to foreign authorities (DSL Art 36).
7. Review rights and incidents: test DSAR fulfilment timeliness and incident-response readiness, including notification records and drill evidence.
8. Evaluate governance: assess DPO effectiveness, compliance-audit cadence, training and management oversight.
9. Report and remediate: produce a findings register scored by severity, with corrective actions, owners and deadlines aligned to filing/testing windows.

Evidence Request List

The following categorised list is issued to the auditee ahead of fieldwork.

• Governance: security and privacy policy suite, org chart, DPO and local-representative appointments, compliance-audit reports, training records.
• Grading & filing: MLPS grading reports, PSB filing certificates, dengbao test reports and remediation logs.
• Data mapping: system inventory, data catalogue with DSL tiers, RoPA, data-flow diagrams, important-data register.
• PI processing: privacy notices (versioned), consent logs, separate-consent records, retention schedule, deletion logs.
• Sensitive PI & minors: sensitive-PI register, children's data policy, guardian-consent records.
• Cross-border: PIPIAs, CAC security assessment approvals, filed Standard Contracts, certifications, transfer consent records.
• Technical: IAM/MFA configuration, encryption and SM-crypto certificates, SIEM/log retention proof, backup/restore test records, network diagrams.
• CII (if applicable): CII designation notice, localisation attestations, procurement security-review approvals, annual assessment reports.
• Incident: IR plan, drill records, incident register, authority and individual notification evidence.
• Vendors & AI: processor agreements, sub-processor approvals, algorithm filings, generative-AI self-assessments and labelling evidence.

Roles and Responsibilities

KPIs / Metrics to Track

• Percentage of in-scope systems correctly graded and filed (target 100%).
• Grade 3+ systems with a current, passed dengbao test.
• DSAR/rights requests fulfilled within committed timelines.
• Percentage of cross-border flows covered by a valid transfer mechanism and current PIPIA.
• Consent capture rate and separate-consent coverage for sensitive PI/transfers.
• Time to notify authority and individuals after a confirmed breach.
• Number of important-data risk assessments completed on schedule.
• Open high-severity findings age and remediation burn-down.
• Security-training completion and incident-drill frequency.
• Algorithm/AI services with current CAC filings and self-assessments.

Readiness Checklist

• All in-scope systems graded under MLPS and Grade 2+ filed with the PSB.
• Grade 3+ systems have a passed dengbao test and a security management centre.
• Data classified into DSL tiers with an important-data register maintained.
• CII applicability determined and, if designated, localisation and procurement review in place.
• PIPL lawful basis, notices and consent (including separate consent) implemented at every collection point.
• Sensitive PI and minors' data controls, with PIPIAs, in place.
• DPO appointed and, for extraterritorial processing, a local representative filed with CAC.
• Every cross-border flow uses an approved mechanism (CAC assessment / SCC / certification) with a retained PIPIA.
• Individual rights workflows (access, correction, deletion, portability, explanation) operating.
• Incident response plan tested, with authority and individual notification procedures.
• Mandatory compliance audit scheduled and vendor/AI filings current.
• Records (RoPA, PIPIA, incidents) retained for at least three years.

Common Gaps and Findings

• Under-grading MLPS systems to avoid dengbao testing and management-centre obligations.
• Treating GDPR compliance as sufficient, missing PIPL's separate-consent and no-legitimate-interest requirements.
• Cross-border transfers running without a completed PIPIA or an approved transfer mechanism.
• Missing or generic consent that fails the 'separate consent' standard for sensitive PI, sharing and export.
• No appointed local representative despite extraterritorial (Art 3(2)) processing.
• Data localisation not enforced for CII or above-threshold PI handlers.
• Sensitive-PI and minors' data processed without PIPIA or guardian consent.
• Retention periods undefined or excessive, breaching the minimisation principle.
• Incident-response plans untested and unclear authority-notification timelines.
• DSL Article 36 exposure: responding to foreign legal requests without Chinese approval.
• Algorithmic recommendation and generative-AI services unfiled with the CAC registry.

China PIPL/CSL Mapped to Other Frameworks

The mapping below helps organisations reuse existing controls, while flagging where China-specific obligations have no direct equivalent.

Frequently asked questions

Need help with China PIPL/CSL?

CERT-In empanelled, PCI QSA senior auditors can take you from reading about it to compliant — with a scoped, guided programme.