ARTICLE · 09 MAY 2022

Part 3: PIPL's Localization Requirements And Restrictions On Responding To Foreign Judicial And Enforcement Agencies

Cooley LLP

The PIPL also introduces a "blocking statute" that restricts personal information processors from providing personal information stored within China to foreign judicial or enforcement agencies.

GlobalPrivacy

Bartholomäus Regenhardt

Author LinkedIn connections

Localization requirements

China's Personal Information Protection Law (PIPL) requires that operators of critical information infrastructure (e.g., China Mobile) and personal information processors that process personal information in an amount that reaches "the threshold specified by" the Cyberspace Administration of China (CAC) store personal information collected and generated in China locally.¹ These entities can only export personal information when it is necessary (this may include for a business purpose) and after passing a security assessment administered by the CAC.²

As discussed in our first blog post of this series, in October 2021, the CAC released for public comment the draft Security Assessment Measures for Cross-Border Data Transfer, which provide further clarity on the scope, criteria and process for carrying out a security assessment. Under the such draft, the threshold specified by the CAC is set as:

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Part 3: PIPL's Localization Requirements And Restrictions On Responding To Foreign Judicial And Enforcement Agencies

Localization requirements

Related Articles

California SB 923: Marketing Finds The Consumer But Deletion Does Not

Navigating The Emerging Patchwork Of State Chatbot Laws (Video)

Misleading Privacy Claims Can Trigger Massive Consumer-Protection Liability

Washington Supreme Court Rejects Privacy Class Action And Holds That Hospital’s Use Of Meta Pixel Does Not Violate State Privacy Act

California Narrows CIPA Litigation: SB 690 Ends Pen Register And Trap-and-Trace Claims

Read more about

Related Comparative Guides

Data Protection & Cybersecurity

See more popular content from

California Enacts First-of-Its-Kind Legislation Governing Lawyer AI Use

SB 54 Is In Effect: What California’s New Packaging Law Means For Your Business

Connecticut’s Newly Enacted Data Broker Law: How It Stacks Up Against California’s Delete Act

Did UPMC Data Breach Ruling Lock Plaintiffs Out Of State Court?

California's Fall 2026 Privacy Roundup: Expanded CCPA Deletion Rights And More

California’s 2026 Legislative Session Wraps: A Wave Of Privacy And AI Bills Reaches The Governor, With Key Child Safety And AI Measures Signed Into Law

Eleventh Circuit Developments: Decisions On Florida And Georgia Social Media/Minor Laws And New Alabama Law

New Laws Target Youth-Facing AI And Online Services

META Settles Multi-state Child Safety And Privacy Litigation

California's "Delete Act" Takes Aim At Data Brokers