ข้ามไปยังเนื้อหาหลัก

Record of Processing Activities (Art. 30 GDPR · PDPA ม.39) → China (PIPL) 🇨🇳

Personal Information Protection Law 2021 · Cyberspace Administration of China (CAC)

From 55,000-185,000 บาท14-45 working days
083-249-4999 Chat on LINE

China (PIPL) is regulated by Cyberspace Administration of China (CAC) under Personal Information Protection Law 2021 — breach notification with no universal window.

500+ compliance programs delivered — covering PDPA, GDPR, CCPA, PIPL, LGPD, PIPA, APPI, DPDPA.

China (PIPL) legal regime: Personal Information Protection Law 2021 — enforced by Cyberspace Administration of China (CAC) with max fines of RMB 50M or 5% turnover. PIPL + DSL + CSL trilogy — CAC security assessment for cross-border + standard contract filing.

Breach notification: No fixed window — recommend best-practice 48-72 hours.

End-to-end: Record of Processing Activities (Art. 30 GDPR · PDPA ม.39) → mapping → control implementation → Cyberspace Administration of China (CAC) registration (where applicable) → ongoing audit.

GDPR fine avoidance — 0 enforcement actions in 4 years (n=42 EU-facing clients) via proactive DPIA + SCC + Art. 27 representative.

Coverage

Thailand PDPA Compliance Pack (PDPA B.E. 2562)
🇨🇳 China (PIPL)
EU GDPR Compliance Pack (Regulation 2016/679)
🇨🇳 China (PIPL)
CCPA/CPRA Compliance (California Consumer Privacy Act)
🇨🇳 China (PIPL)
DPO Appointment Service (PDPA & GDPR)
🇨🇳 China (PIPL)
DPIA (Data Protection Impact Assessment)
🇨🇳 China (PIPL)
SCCs + BCRs (International Data Transfer)
🇨🇳 China (PIPL)
Breach Response & 72-Hour Notification
🇨🇳 China (PIPL)
Cookie Consent + Consent Management Platform
🇨🇳 China (PIPL)
Data Subject Access Request (DSAR) Handler
🇨🇳 China (PIPL)
Privacy Policy + Terms of Service Drafting
🇨🇳 China (PIPL)
ISO/IEC 27701 PIMS Certification Readiness
🇨🇳 China (PIPL)

How it works

  1. 1

    Map Personal Information Protection Law 2021

    Compliance plan aligned with Cyberspace Administration of China (CAC).

  2. 2

    Prepare Record of Processing Activities (Art. 30 GDPR · PDPA ม.39)

    14-45 working days at 55,000-185,000 บาท.

  3. 3

    Transfer mechanism

    SCC + BCR + TIA + adequacy assessment as required.

  4. 4

    Local representative

    Local DPO or representative per destination law.

  5. 5

    DPA registration

    Notification/filing with Cyberspace Administration of China (CAC) where required.

  6. 6

    Ongoing monitoring

    Quarterly review + annual audit + breach drill + DSAR queue monitoring.

Frequently asked questions

Which law applies in China (PIPL)?

Personal Information Protection Law 2021

Supervisory authority?

Cyberspace Administration of China (CAC)

Maximum fine?

RMB 50M or 5% turnover

Breach window?

No fixed window — best-practice 48-72 hours.

Market-specific caution?

PIPL + DSL + CSL trilogy — CAC security assessment for cross-border + standard contract filing.

Local representative required?

Depends on scope of processing.

Cross-border transfer requirements?

SCC + TIA + (for CN/RU) data localisation + government security assessment.

Related services

Back to Record of Processing Activities (Art. 30 GDPR · PDPA ม.39) All jurisdictions 🇹🇭 Thailand (PDPA) 🇪🇺 European Union (GDPR) 🇬🇧 United Kingdom (UK GDPR + DPA 2018) 🇺🇸 California (CCPA/CPRA)