How Does China’s PIPL Affect Biometric Data for Foreign Companies?

An in-depth examination of the Personal Information Protection Law’s impact on foreign companies handling biometric data in China

Introduction: PIPL’s Transformative Impact on Biometric Data Governance

China’s Personal Information Protection Law (PIPL), which took effect on November 1, 2021, fundamentally reshaped the legal landscape for biometric data processing in China. For foreign companies, the PIPL is not merely a local data protection statute—it is a regulatory framework with significant extraterritorial reach that directly affects global operations, HR systems, customer-facing applications, and technology deployments. Understanding how the PIPL specifically governs biometric data is critical for any foreign enterprise with a presence in or business relationship with China.

The PIPL treats biometric data as “sensitive personal information” (敏感个人信息), subjecting it to the highest tier of protection within the law’s multi-layered framework. This classification triggers obligations that go well beyond those applicable to ordinary personal data, including enhanced consent requirements, mandatory impact assessments, data localisation mandates, and strict cross-border transfer controls. For foreign companies accustomed to handling biometric data under GDPR or other regimes, the PIPL introduces distinctive requirements that require careful navigation.

This article analyses the specific provisions of the PIPL that affect biometric data processing by foreign companies, highlighting the key differences from other regimes, the operational implications, and practical compliance strategies.

1. The Sensitive Personal Information Classification

1.1 Legal Basis Under Article 28

Article 28 of the PIPL explicitly includes biometric data within the definition of sensitive personal information. The legal consequences of this classification are far-reaching:

• Specific purpose limitation: Biometric data can only be processed for specific, explicitly stated purposes that are strictly necessary for the processing activity
• Enhanced transparency: Data subjects must be informed of the necessity of processing and the impact on their rights and interests
• Separate consent: Consent for biometric processing must be obtained through a separate consent action, not bundled with other consents
• Impact assessment: A Personal Information Protection Impact Assessment (PIPIA) must be conducted and documented before any biometric processing begins
• Record-keeping: Detailed records of biometric processing activities, including consent records, impact assessments, and processing logs, must be maintained
• Security measures: Enhanced technical and organisational security measures appropriate to the sensitivity of biometric data must be implemented

1.2 Scope of Biometric Data Under the PIPL

The PIPL does not provide an exhaustive list of biometric data types, but regulatory guidance and national standards have clarified that biometric data includes:

• Facial recognition data (face prints, facial feature vectors)
• Fingerprint data and palm print data
• Iris scans and retina scans
• Voiceprints and speaker recognition data
• Gait patterns and behavioural biometrics
• Genetic data (in certain contexts, particularly healthcare and life sciences)
• Signature dynamics and keystroke dynamics (increasingly recognised as biometric)
• Hand geometry and vein patterns

Foreign companies should adopt a broad interpretation of biometric data for compliance purposes, as regulators have shown a willingness to expand the scope through enforcement actions and guidance.

2. Extraterritorial Reach: When PIPL Applies to Foreign Companies

One of the most significant aspects of the PIPL for foreign companies is its extraterritorial application under Article 3. The law applies to processing activities conducted outside China where the activity involves:

2.1 Providing Products or Services to Individuals in China

A foreign company that offers products or services to individuals located in China and collects biometric data in connection with those products or services is subject to the PIPL. Common scenarios include:

• A global e-commerce platform that uses biometric authentication for Chinese users
• A foreign fintech company offering payment services to Chinese customers
• A multinational hotel chain collecting biometric data from Chinese guests for check-in

2.2 Analysing or Evaluating Behaviour of Individuals in China

If a foreign company analyses or evaluates the behaviour of individuals in China (e.g., through biometric-based customer analytics, employee monitoring, or fraud detection), PIPL applies even if the company has no physical presence in China.

2.3 Other Circumstances Provided by Law

This catch-all provision allows Chinese regulators to extend PIPL’s reach to other scenarios as determined by subsequent regulations or enforcement actions.

2.4 Designated Representative Requirement

Foreign companies subject to PIPL’s extraterritorial provisions must establish a designated representative or appoint a representative entity in China to handle compliance matters, including liaison with regulators and response to data subject requests.

3. Impact on Cross-Border Biometric Data Flows

The PIPL’s cross-border data transfer rules have a particularly pronounced impact on foreign companies’ handling of biometric data:

3.1 Data Localisation Mandate

Article 36 of the PIPL requires that all sensitive personal information (including biometric data) collected in China be stored within China. This means foreign companies cannot maintain a single global biometric database that includes Chinese employee or customer data without implementing local storage.

3.2 Transfer Mechanisms

For any cross-border transfer of biometric data, foreign companies must use one of the following mechanisms:

• CAC Security Assessment: Required for data processors handling large volumes of personal information. For biometric data specifically, the risk of exceeding thresholds is high given the sensitivity classification.
• Standard Contractual Clauses (SCCs): May be used for smaller-scale transfers but require filing with provincial CAC offices and conducting a transfer impact assessment.
• Professional Certification: Available through CAC-accredited certification bodies, though this route is less commonly used and involves its own compliance burden.

3.3 Consent for Cross-Border Transfer

In addition to the general consent requirements for biometric data processing, cross-border transfers require that individuals be specifically informed about:

• The identity of the overseas recipient and their contact information
• The purpose of the overseas processing
• The types of biometric data being transferred
• The overseas retention period
• The mechanisms for protecting the data abroad
• How individuals can exercise their rights with respect to transferred data

4. Impact on Human Resources and Employment

For foreign companies with operations in China, the PIPL’s impact on HR-related biometric data processing is one of the most significant operational challenges:

4.1 Employee Biometric Systems

Many foreign companies in China use biometric systems for employee access control, attendance tracking, and identity management. Under the PIPL, these systems must:

• Be justified by documented necessity (security requirements of the facility)
• Offer non-biometric alternatives for employees who decline consent
• Obtain separate consent from each employee
• Be covered by a PIPIA
• Store biometric templates locally in China
• Have clear deletion policies for departing employees

4.2 Global HR Systems

Multinational corporations that use global HR platforms (such as SAP SuccessFactors, Workday, or Oracle HCM) face particular challenges. If biometric data from Chinese employees is accessible through a global HR system hosted outside China, the cross-border transfer requirements are triggered. Companies must either:

• Isolate Chinese employee biometric data within a local instance of the HR system
• Implement one of the approved cross-border transfer mechanisms
• Use domestic Chinese HR systems for biometric processing

5. Impact on Customer-Facing Applications

For foreign companies providing digital services to Chinese consumers, the PIPL imposes additional obligations:

• App store compliance: The CAC conducts regular app rectification campaigns, requiring apps to remove excessive biometric data collection and implement proper consent mechanisms
• Verification alternatives: Biometric authentication cannot be the only method of identity verification
• Data minimisation: Only the minimum biometric data necessary for the specific service may be collected
• Local processing: Biometric data from Chinese customers must be processed on servers in China

6. PIPIA Requirements Under the PIPL

The Personal Information Protection Impact Assessment (PIPIA) is a mandatory prerequisite for biometric data processing. The PIPIA must include:

• Description of the processing purpose and methods
• Assessment of necessity and proportionality
• Identification and analysis of risks to individual rights and interests
• Description of planned risk mitigation measures
• Evaluation of the effectiveness of security measures

Foreign companies should document PIPIAs in writing and retain them for at least three years after the processing activity ceases. PIPIAs must be updated when processing purposes, methods, or risk profiles change significantly.

7. Enforcement and Penalties for Non-Compliance

The PIPL provides for substantial penalties for violations related to biometric data:

• Administrative fines: Up to RMB 50 million or 5% of the previous year’s annual revenue, whichever is higher
• Suspension of operations: Regulators may order suspension of relevant business activities for serious violations
• Revocation of licences: In extreme cases, business licences may be revoked
• Personal liability: Directly responsible individuals may face fines of RMB 10,000–100,000 and potential employment bans
• Civil liability: Data subjects may claim damages through litigation
• Reputational damage: Enforcement actions are often publicised, creating significant reputational risk

8. Practical Compliance Strategies Under the PIPL

1. Conduct a comprehensive audit of all biometric data processing activities across Chinese operations, including HR, facilities, IT, customer service, and third-party vendor arrangements.
2. Map data flows to identify where biometric data originates, how it flows within the organisation, whether it crosses borders, and who has access.
3. Implement local storage infrastructure by partnering with Chinese cloud providers (Alibaba Cloud, Tencent Cloud, or AWS China/Azure China operating through local partners).
4. Revise consent mechanisms to ensure separate, explicit consent for biometric data, with clear disclosures and easy withdrawal mechanisms.
5. Prepare PIPIAs for all biometric processing activities before deployment, documenting necessity, risk assessment, and mitigation measures.
6. Establish cross-border transfer mechanisms where needed, including SCCs or security assessment applications.
7. Review vendor contracts to ensure Chinese vendors handling biometric data have adequate data protection provisions and comply with PIPL requirements.
8. Appoint a local data protection officer or responsible person with authority over PIPL compliance for biometric data.
9. Develop incident response plans specific to biometric data breaches, which have unique notification and remediation requirements.
10. Monitor regulatory developments including implementing regulations, national standards, and enforcement trends that may affect biometric data compliance obligations.

9. PIPL vs. GDPR: Key Differences for Biometric Data

Foreign companies familiar with the GDPR should note several key differences in how the PIPL treats biometric data:

• Separate consent vs. explicit consent: PIPL requires a separate consent action for biometric data, whereas GDPR requires explicit consent (which can be integrated into a broader consent framework).
• Data localisation: PIPL mandates that biometric data be stored in China, whereas GDPR does not impose local storage requirements per se (though adequacy decisions may apply).
• Transfer mechanisms: PIPL’s security assessment and SCC mechanisms differ significantly from GDPR’s adequacy decisions, SCCs, and BCRs.
• Enforcement approach: Chinese enforcement has been more app-and-sector focused, with regular campaign-style rectification actions that are less common under GDPR.
• Penalty structure: PIPL penalties can reach 5% of annual revenue (higher than GDPR’s 4% maximum for most violations).
• Employee consent: PIPL does not include the GDPR’s Article 6(1)(b) performance-of-contract basis that is sometimes used to justify employee data processing without consent for biometric data.

Conclusion: PIPL Compliance as a Strategic Imperative

The PIPL’s regulation of biometric data represents one of the most comprehensive and demanding frameworks globally. For foreign companies, the impact extends far beyond compliance documentation—it affects system architecture, HR operations, technology procurement, vendor management, and data governance strategies.

Companies that approach PIPL compliance as a strategic investment rather than a legal burden will be better positioned to leverage biometric technologies legitimately while maintaining regulatory compliance and stakeholder trust. The PIPL is not merely a compliance hurdle to be overcome; it is a framework that, when properly understood and implemented, provides a clear operational framework for responsible biometric data management in one of the world’s most important markets.