How to Conduct a PIPIA in China, Step‑by‑step Process and Checklist

Every organisation that processes personal information in China, or that transfers the personal data of individuals located in the People’s Republic of China across its borders, must understand how to conduct a PIPIA in China. A Personal Information Protection Impact Assessment (PIPIA) is the formal risk evaluation mandated by Article 55 of the Personal Information Protection Law (PIPL), requiring personal information handlers to assess the legality, necessity and potential risks of specified high‑risk processing activities before those activities begin. The obligation extends to domestic enterprises, critical information infrastructure (CII) operators, foreign controllers offering services to individuals in China, and any handler that engages in cross‑border data transfers, sensitive‑data processing or automated decision‑making.

With the CAC/SAMR Measures for Certification of Cross‑Border Transfer of Personal Information taking effect on 1 January 2026, and the Administrative Measures on Personal Information Protection Compliance Audits already in force since early 2025, organisations now face tighter timelines, heavier documentation burdens and a genuine expectation that PIPIA records will be produced during regulatory audits. This guide sets out the complete PIPIA procedure: who must run it, the six core steps, every document you need to retain, realistic cost ranges and the 2026 regulatory changes that make immediate action essential.

Overview of the PIPL Impact Assessment and Who It Applies To

A PIPIA is China’s equivalent of a Data Protection Impact Assessment (DPIA) under the EU’s GDPR, but with important structural differences. Under PIPL Article 55, the assessment must evaluate the lawfulness and necessity of the processing activity, the degree of impact on the rights and interests of individuals, and the effectiveness of protective measures adopted. The results, and the remedial actions taken, must be recorded and retained for a minimum of three years.

The scope of the obligation is broad. Any entity that qualifies as a “personal information handler” under PIPL, whether a Chinese domestic company, a joint venture, a wholly foreign‑owned enterprise or an offshore controller that processes data of individuals within mainland China, must conduct a PIPIA before commencing any of the high‑risk processing scenarios set out in Article 55. CII operators face additional scrutiny because their processing activities often involve “important data” subject to separate security‑assessment obligations under PIPL Article 38 and the CAC’s cross‑border transfer rules.

The practical importance of the PIPIA has increased sharply since 2025. Regulators now treat the PIPIA report and its supporting documents as front‑line audit evidence. Under the Administrative Measures on Personal Information Protection Compliance Audits issued on 12 February 2025, auditors appointed by the Cyberspace Administration of China (CAC) may request PIPIA records, risk matrices and remediation logs during both routine and triggered audits. Organisations that lack complete PIPIA documentation face enforcement risk even where the underlying processing activity is otherwise lawful. For businesses operating across borders, the PIPIA also forms a mandatory prerequisite for the new PIP Certification route introduced under the CAC/SAMR Measures effective 1 January 2026.

Any company considering foreign investment in China should treat PIPIA readiness as a day‑one compliance workstream.

PIPIA Requirements: Eligibility and Prerequisites

Article 55 Triggers, When a PIPIA Is Required

PIPL Article 55 mandates a PIPIA before a handler undertakes any of the following activities:

• Processing sensitive personal information. This includes biometric data, religious beliefs, specific identity information (e.g. national identification numbers), medical and health data, financial account data, location tracking data and personal information of minors under the age of fourteen.
• Automated decision‑making involving personal information. This covers algorithmic profiling, personalised pricing, automated content recommendation and AI‑driven risk scoring, a trigger of particular relevance to internet platforms, ad‑tech companies and connected‑vehicle manufacturers.
• Entrusted processing, provision to third parties or public disclosure. Any arrangement in which personal information is shared with a data processor, another handler or the public requires prior assessment.
• Cross‑border transfer of personal information. Whether via security assessment, Standard Contractual Clauses (SCCs) or the new PIP Certification route, every cross‑border transfer triggers a PIPIA.
• Other processing activities with a significant impact on individuals’ rights. This catch‑all covers large‑volume processing (industry observers generally treat one million individuals’ data as the threshold) and any novel technology deployment.

Internal Prerequisites Before Starting the Assessment

Before the PIPIA itself can begin, several internal foundations must be in place. Organisations need a current and accurate data inventory that maps every category of personal information collected, the purpose and legal basis for processing, data flows (including cross‑border transfers) and the identities of all processors and sub‑processors. A designated Data Protection Officer (DPO) or privacy lead must be appointed, PIPL Article 52 requires this for handlers processing personal information above prescribed volume thresholds. All internal privacy policies, privacy notices and consent mechanisms must be available in Simplified Chinese; this is both a statutory and a practical requirement, because regulators expect filings and audit materials in Chinese.

Finally, the handler should have documented its legal basis for each processing activity under PIPL Articles 13 and 14 before the assessment commences.

Who Must Approve, Internal Sign‑Offs

A compliant PIPIA is not a desk exercise completed by the privacy team alone. Best practice, and the standard that regulators expect to see evidenced in audit documentation, involves sign‑off from at least three functions: the DPO or Head of Privacy, the Head of Legal / General Counsel and the Chief Technology Officer or Chief Information Security Officer. Where the PIPIA identifies material residual risk (for example, a novel AI processing activity or a first‑time cross‑border transfer to a jurisdiction without an adequacy arrangement), escalation to the CEO or Board is advisable. The signed approval record must be retained alongside the PIPIA report.

How to Conduct a PIPIA in China, the Six Essential PIPIA Steps

The following six steps represent the core procedural sequence for conducting a compliant PIPIA. Each step identifies the responsible function, required inputs and outputs, and a realistic duration range based on market practice for mid‑to‑large‑scale processing activities. The PIPIA timeline table below summarises the full process.

Step 1, Define Scope and Complete the Data Inventory

Identify every processing activity that falls within the Article 55 triggers. For each activity, map the categories of personal information collected, the data subjects affected (employees, consumers, minors), the data flows from collection through storage to deletion, and every third party, processor, sub‑processor, group company or overseas recipient, that touches the data. Record volumes (number of data subjects and records) and whether the data crosses China’s border at any point. The output is a completed data‑flow diagram and a scoping memo that defines the PIPIA’s boundary. This step typically takes 3–10 business days; complex multi‑product organisations or connected‑vehicle platforms may need longer.

Step 2, Assess Legal Basis and Run the Necessity Test

For each processing activity within scope, document the specific legal basis relied upon under PIPL Article 13 (consent, contract performance, legal obligation, public interest, etc.). Where the handler relies on consent, confirm that the consent mechanism meets the “voluntary, explicit and informed” standard of PIPL Article 14, and that separate consent has been obtained for sensitive‑data processing and cross‑border transfers where required. Critically, apply the necessity test: is the volume and type of personal information collected the minimum necessary to achieve the stated purpose? The output is a legal basis assessment memo, signed by in‑house counsel. Duration: 2–5 business days.

Step 3, Conduct Risk Identification and Impact Analysis

This is the core analytical step. Identify every risk to individual rights and interests arising from the processing activity, score each risk by likelihood and severity, and document the rationale. Common risk categories include: unauthorised access or data breach, excessive data collection, opaque automated decision‑making, re‑identification of de‑identified data, and loss of control by data subjects over cross‑border transfers. For AI and automated decision‑making systems, assess the risk of discriminatory outcomes, unexplainable decisions and the absence of a manual review mechanism, all of which are specific concerns under PIPL Article 24. Connected‑vehicle and telecom operators should assess risks related to real‑time location tracking, subscriber metadata and vehicle telemetry.

The output is a risk matrix with likelihood/impact scores and a prioritised list of risks requiring mitigation. This step takes 5–10 business days for most organisations, and is the area where evolving global data privacy standards provide useful comparative benchmarks.

Step 4, Design Safeguards and Review Contractual Measures

For each identified risk, document the technical, organisational and contractual safeguards that will reduce the risk to an acceptable level. Technical measures include encryption at rest and in transit, access controls, pseudonymisation, audit logging and intrusion detection. Organisational measures include staff training, incident‑response procedures and data‑retention policies. Where the PIPIA covers a cross‑border transfer, this step must also identify the applicable transfer mechanism, CAC security assessment, SCCs or PIP Certification, and confirm that the relevant filings, contracts or certification applications are in place or in progress. Review all processor and sub‑processor agreements for compliance with PIPL Article 21, ensuring they specify processing purpose, duration, method, categories of data, protective measures and obligations on deletion.

The output is a safeguards schedule mapped to each risk and updated contracts where gaps are identified. Duration: 5–20 business days, depending on the number of processor relationships and cross‑border arrangements.

Step 5, Draft the PIPIA Report and Obtain Sign‑Off

Compile the findings from Steps 1–4 into a formal PIPIA report. The report should contain, at minimum: an executive summary; a description of the processing activity and its scope; the legal basis and necessity analysis; the risk matrix; the safeguards schedule; residual risks and recommended remedial actions; a conclusion on whether the processing may proceed; and a sign‑off page. Prepare a separate one‑page executive summary in Simplified Chinese, this is the document most likely to be requested first during a CAC audit. The report must be signed by the DPO, Head of Legal and CTO (or equivalent). Where material residual risk remains, escalate to the CEO or Board before processing commences. Retain both PDF and editable versions.

Duration: 2–7 business days for drafting and sign‑off circulation.

Step 6, Implement Remedial Actions, Monitor and Schedule Reviews

A PIPIA is not a one‑time filing. Implement all remedial actions identified in the report, engineering fixes, contract amendments, consent mechanism updates, before the processing activity goes live. Establish a monitoring cadence: the DPO should review the PIPIA at least quarterly against key risk indicators and formally reassess it annually or whenever a material change occurs. Material changes include launching a new product feature, onboarding a new processor, expanding to a new data category, deploying a new AI model or experiencing a data breach. Every update must be version‑controlled, and the change log retained for audit. Organisations preparing for technology transfer arrangements in China should integrate their PIPIA review cycle with technology‑compliance milestones.

Implementation of remedial actions typically takes 2–90 days depending on their nature and scale; ongoing monitoring is continuous.

PIPIA Documents Needed, Required Records and Retention

The table below lists the documents that should form a complete PIPIA file. Under PIPL Article 55, the assessment results and handling records must be retained for at least three years. Industry best practice, and the standard recommended by Big Four advisory firms, is to retain the full file for five years, particularly where the processing involves cross‑border transfers or sensitive data. All regulator‑facing documents should be available in Simplified Chinese.

When assembling the file for a regulator audit, package the executive summary on top, followed by the full PIPIA report, risk matrix, sign‑off record and then supporting evidence. Auditors appointed under the February 2025 Administrative Measures typically begin by requesting the executive summary and sign‑off record before drilling into technical evidence.

PIPIA Timeline and Key Deadlines

The single most important timing rule is that a PIPIA must be completed before the relevant processing activity begins. This applies to new product launches, new cross‑border transfer arrangements, new processor relationships and any expansion into sensitive‑data categories. For organisations planning to apply for PIP Certification under the CAC/SAMR Measures effective 1 January 2026, the PIPIA should ideally be finalised at least three months before the certification application is submitted. This allows time for remedial actions and for the certification body to review the PIPIA file as part of its assessment.

Security assessment applications filed with the CAC for cross‑border transfers of data above the prescribed thresholds carry their own processing window, historically around 45 business days, with potential extensions. The PIPIA must be completed before the security assessment application is submitted, because the CAC may request it as part of the filing package.

Organisations should build PIPIA re‑assessment into their product development lifecycle. Any material change to data processing, a new AI model, an additional data category, a change of overseas recipient, or a data breach, triggers the obligation to re‑run the PIPIA. Industry observers expect the CAC to scrutinise update frequency during audits, and a stale PIPIA covering processing that has materially evolved is likely to be treated as non‑compliant. Retain all versions and their change logs for a minimum of three years, with five years as the recommended standard.

Costs, Fees and Budget Considerations for a PIPIA in China

There is no government filing fee for conducting a PIPIA itself, but the total cost of a compliant assessment can be significant. The table below sets out indicative cost ranges based on market practice; actual costs will vary by sector, data volume, number of cross‑border transfers and organisational complexity.

Organisations should budget for PIPIAs as an operational expense rather than a one‑off capital item, given the ongoing monitoring and periodic reassessment obligations. For multinationals with complex data architectures, the initial PIPIA may represent the single largest line item in the first‑year PIPL compliance budget, but subsequent annual reviews are typically less resource‑intensive provided the monitoring framework is well established.

What Changes in 2026, Certification and Audit Rules Affecting the PIPIA Process

Two regulatory developments that took shape in 2025 have materially changed how organisations should approach the PIPIA process from 2026 onwards.

PIP Certification as a cross‑border transfer route. The Measures for Certification of Cross‑Border Transfer of Personal Information, jointly issued by the CAC and SAMR on 14 October 2025 and effective from 1 January 2026, establish personal‑information protection certification as a recognised mechanism for certain cross‑border data transfers. Organisations that choose the certification route must demonstrate, to an accredited certification body, that they have conducted a compliant PIPIA covering the relevant transfer. The likely practical effect is that organisations will need to complete the PIPIA, implement all remedial actions and assemble the full documentation package before engaging the certification body, adding at least three months to the pre‑transfer timeline.

Compliance audit expectations. The Administrative Measures on Personal Information Protection Compliance Audits, published on 12 February 2025, formalise the CAC’s power to require personal information handlers to engage professional auditors to review their PIPL compliance. The Measures specifically contemplate that auditors will request PIPIA reports, risk assessments and remediation records. Handlers that process the personal information of more than one million individuals, or that handle sensitive personal information on a large scale, face a higher likelihood of audit selection. Early indications suggest that regulators are prioritising sectors where automated decision‑making PIPIA obligations are most acute, AI platforms, internet advertising, financial technology and connected vehicles.

The combined effect of these two developments is clear: organisations should run PIPIAs earlier in the product development cycle, maintain them as living documents, and ensure the full PIPIA file is audit‑ready in Simplified Chinese at all times. The era in which a PIPIA could be treated as a back‑office compliance formality is over.

Common Pitfalls and How to Avoid Them

• Using generic data processing agreements without Chinese‑language compliance. Global templates drafted for GDPR purposes rarely satisfy PIPL Article 21 requirements. Ensure all processor agreements are localised, reference the PIPL and include Chinese‑language versions for regulator review.
• Failing to re‑run the PIPIA after product changes. Deploying a new AI feature, adding a data category or switching a cloud provider constitutes a material change. A PIPIA that pre‑dates the change will be treated as incomplete during an audit.
• Inadequate vendor due diligence for sub‑processors. Handlers remain accountable for their processors’ conduct. Request SOC 2 reports, complete security questionnaires and document the due‑diligence process in the PIPIA file.
• Missing or incomplete sign‑off records. Auditors check who approved the PIPIA and when. A report without dated signatures from the DPO, Head of Legal and CTO is a red flag.
• Weak cross‑border transfer documentation. Where a security assessment or SCC filing is required, the PIPIA must explicitly address the transfer risks and reference the filing. A standalone PIPIA that ignores the cross‑border element will not satisfy CAC expectations.
• Overlooking automated decision‑making triggers. AI recommendation engines, algorithmic pricing and automated credit scoring all require a PIPIA. Connected‑vehicle manufacturers collecting real‑time telemetry and telecom operators processing location data face the same obligation. Treat any algorithm that produces decisions affecting individual rights as a trigger.

Sources

1. National People’s Congress, Personal Information Protection Law (PIPL) Official English Text
2. Cyberspace Administration of China (CAC), Notice on Draft Certification Measures (January 2025)
3. Arnold & Porter, China Requirements for Personal Information Protection Certification
4. China Briefing, China Cross‑Border Data Transfer Certification
5. Shanghai Pacific Legal, China Issues Regulations on Personal Information Protection Compliance Audits
6. China Briefing, How to Conduct a Personal Data Impact Assessment in China
7. Securiti, Personal Information Protection Impact Assessment (PIPIA) Under China PIPL
8. KPMG, Understanding and Recommended Action Plans for Measures for Standard Contracts for Cross‑Border Transfer of Personal Information
9. AllBright Law, Personal Information Protection Compliance Audits Summary