language: en · source language: zh · status: in-force · last checked: 2026-09-06

China — Personal Information Protection Law (个人信息保护法)

China's omnibus privacy law (2021). Extraterritorial: it reaches processing outside China that targets people in China (art. 3(2)). Direct contracting confirmed 2026-09-06 — we carry the compliance burden ourselves.

Statute text is Chinese (the authentic language); this README is curation.

Applicability to EdTech

• Minors under 14 are doubly protected: their personal information is 敏感个人信息 by definition (第二十八条), and processing requires parent/guardian consent plus dedicated processing rules (专门的个人信息处理规则, 第三十一条) — a documented, minors-specific privacy policy is a hard requirement.
• Lawful bases (第十三条): consent, contract/HR necessity, legal duties, emergencies, limited news/public-interest grounds, lawfully disclosed data — no general legitimate-interest ground: school deployments run on consent or contract necessity.
• Cross-border transfers are the hard constraint (第三十八条): a CAC security assessment, certification, or CAC standard contract is needed to move Chinese personal information abroad, plus separate consent; state organs and CIIOs must localise (第四十条) — architecture question: keep Chinese school data in-country or run a transfer mechanism.

Contents

Enforcement

国家互联网信息办公室 (CAC) and sector regulators; fines up to ¥50m or 5% of prior-year turnover (第六十六条, not extracted).

Licence

The corpus reproduces selected articles of the 个人信息保护法 from the CAC's official full-text page.

Chinese copyright law does not apply to laws and regulations. 《中华人民共和国著作权法》第五条 (中国政府网 — 中华人民共和国著作权法, read 2026-10-01) provides: "本法不适用于： （一）法律、法规，国家机关的决议、决定、命令和其他具有立法、行政、司法性质的文件，及其官方正式译文；"

The CAC pages carry the site-wide footer "© 版权所有". That notice covers the website; it cannot create copyright in a text that 第五条 excludes, and the CAC publishes no terms that restrict reuse of the legislation it republishes.

Conditions: none attach to the statute text, because no copyright subsists in it. The corpus still identifies its source: each fact document names its source in its opening citation line and in its Meta section, and Sources here links the official text (the CAC). The changes (the selection of provisions, the Markdown layout and the added anchors) are described in Meta. The corpus does not claim that the publisher endorses it, and only the officially promulgated text is authentic.

Related

• CN 网络安全法 — MLPS + CII localisation
• CN 未成年人网络保护条例 — the minors' operational layer
• EU GDPR — the closest structural sibling

Sources

• CAC — 个人信息保护法全文