Does PIPL apply to my foreign company HR data in China?

Does PIPL apply to my foreign company HR data in China?

Yes — the Personal Information Protection Law (PIPL) applies fully to the HR data of foreign-invested enterprises (FIEs) operating in China. Over 62,000 foreign-invested enterprises currently operating in China must comply with PIPL requirements for their employee data, regardless of whether the company is registered as a Wholly Foreign-Owned Enterprise (WFOE), a Joint Venture (JV), or a Representative Office. The extraterritorial reach of the PIPL also captures foreign companies that process HR data of employees based in China, even if the company itself has no legal entity in mainland China.

What HR data falls under PIPL jurisdiction?

Under the PIPL, any information related to an identified or identifiable individual qualifies as personal information. In the HR context, this covers an exceptionally broad range of data points collected during the employment lifecycle:

Any HR data that reveals an employee’s ethnicity, religious beliefs, specific biometric identity, health status, financial situation, or criminal history is classified as sensitive personal information under PIPL Article 28. Processing sensitive PI requires separate explicit consent from the employee, a specific purpose that is necessary for the employment relationship, and a more stringent PIPIA (Personal Information Protection Impact Assessment).

Does China’s Labor Law exemption apply to foreign companies?

A common misconception among foreign businesses is that the PIPL contains a blanket exemption for HR data processing necessary for employment administration, similar to the GDPR’s “necessary for the performance of the employment contract” basis (Article 6(1)(b) GDPR). The PIPL does not provide such a broad employment exemption.

Under PIPL Article 13, the legal bases for processing HR data include:

1. Consent — Explicit consent from the employee for specific processing purposes, which must be freely given, specific, informed, and unambiguous. In an employment context, the power imbalance makes freely-given consent difficult to establish for mandatory HR processes.
2. Necessity for entering into or performing a contract — Processing that is objectively necessary for the employment contract, such as salary payment to the designated bank account. This is the closest analogue to the GDPR’s employment exemption but is interpreted more narrowly by Chinese regulators.
3. Legal obligation — Processing required by Chinese law, such as social insurance contributions, tax withholding, and housing fund management. This covers statutory HR compliance obligations.
4. Vital interests — Processing necessary to protect the life, health, or property of the employee or another individual. This applies in emergency situations.

The critical difference from the GDPR: under PIPL, foreign companies cannot rely on “legitimate interests” as a legal basis for processing employee data. This means every HR data processing activity must be mapped to one of the enumerated legal bases in Article 13, and the justification must be documented and reproducible in a regulatory inspection.

What about cross-border transfer of HR data to headquarters?

This is where PIPL’s impact on foreign companies is most acutely felt. When a foreign company’s Chinese subsidiary transfers employee data to its overseas parent company for global HR management, payroll consolidation, or centralized HR systems, the cross-border data transfer rules apply in full:

• If the Chinese entity processes HR data of 10,000+ employees per year (cumulative across all purposes), SCCs or PIAB certification is required as the transfer mechanism.
• If the Chinese entity processes sensitive HR data (biometrics, health data, financial data, etc.) of 10,000+ individuals cumulatively, a CAC security assessment is required — even if total headcount is below 1 million.
• If the total headcount crosses 1 million (large-volume threshold), a CAC security assessment is mandatory regardless of data type.

For a typical foreign company with 500-5,000 employees in China, the most practical approach is to file SCCs using the CAC’s standard template, covering the transfer of HR data to the overseas parent. The SCC must be accompanied by a PIPIA that specifically addresses the HR data transfer purpose, the necessity of transferring data overseas (rather than processing locally), and the protective measures in place at the overseas recipient.

Do I need a DPO in China for HR data?

Under PIPL Article 52, a foreign company must appoint a Personal Information Protection Officer (PIPO) — analogous to a Data Protection Officer (DPO) — if it processes personal information in any of the following circumstances:

1. The company processes the personal information of more than 1 million individuals annually
2. The company processes the sensitive personal information of more than 10,000 individuals annually
3. The company engages in cross-border data transfers of personal information

Given that most foreign companies with Chinese subsidiaries (a) transfer HR data cross-border and (b) process sensitive PI (biometrics, health data, financial data) for employees, the PIPO appointment is generally mandatory. The PIPO must be a China-based employee with knowledge of the company’s data processing activities and Chinese data protection law. Their contact information must be filed with the local CAC office and a copy maintained in the company’s records.

What are the penalties for non-compliance with PIPL for HR data?

The enforcement landscape for PIPL violations affecting HR data has evolved rapidly. As of 2026, the following penalty ranges apply:

In 2025, at least 12 foreign-invested enterprises were publicly sanctioned by Chinese regulators for HR data compliance failures, with total administrative fines exceeding RMB 15 million. The enforcement trend is accelerating: in the first half of 2026 alone, an additional 7 foreign companies faced penalties for similar violations, indicating that Chinese regulators are intensifying their scrutiny of HR data practices across all foreign-invested sectors. by Chinese regulators for HR data compliance failures, with total administrative fines exceeding RMB 15 million. The most common violations included failure to obtain separate consent for biometric attendance systems, inadequate cross-border transfer documentation, and failure to appoint a qualified PIPO.

What steps should my foreign company take now?

To bring your HR data processing into PIPL compliance, foreign companies should implement the following actions in priority order:

1. Conduct a comprehensive HR data mapping exercise — Identify all HR data collected, processed, and stored for each employee, including data held by third-party HR service providers (payroll processors, benefits administrators, background check firms).
2. Classify all HR data by PIPL category — Distinguish between general personal information and sensitive personal information. Map each data element to its PIPL classification, legal basis for processing, and retention period.
3. Review and update employee privacy notices — Ensure that the employee privacy notice clearly discloses what HR data is collected, the purposes of processing, whether data is transferred cross-border, the legal basis for each processing activity, and the employee’s rights under PIPL.
4. Implement consent management for sensitive HR data — Obtain separate, explicit, and freely-given consent for the processing of biometric data (fingerprint/facial recognition for attendance), health data (medical exams, insurance claims), and financial data beyond payroll (loan applications, stock option administration).
5. Establish cross-border transfer documentation — Execute SCCs with the overseas parent company or affiliate receiving HR data. Complete the PIPIA specifically for the HR data transfer. File the SCC with the provincial CAC office within 10 working days.
6. Appoint and register a PIPO — Designate a qualified China-based employee as the Personal Information Protection Officer, ensure they have the necessary authority and resources, and file their contact information with the CAC.

Foreign companies that have already implemented GDPR-compliant HR data practices should note that PIPL compliance is not a simple re-labeling exercise. The differences in legal bases, consent requirements, cross-border transfer mechanisms, and regulator expectations mean that a dedicated China-specific DPO review aligned with PIPL requirements is necessary.

Where to Go From Here

Based on what you just read:

• Ready to act? Read a step-by-step guide to PIPL compliance for your China HR operations
• Still comparing? See a side-by-side comparison of PIPL vs. GDPR employee data requirements
• Need numbers? Try an interactive HR data compliance checklist for foreign employers in China

Does PIPL apply to my foreign company HR data in China? — first published on China Gateway 360. Last updated: July 2026.

Official Sources

• Cyberspace Administration of China: Personal Information Protection Law
• Cyberspace Administration of China: official policy and regulatory portal
• National Information Security Standardization Technical Committee