PIPL (China Personal Information Protection Law 2021)

China, statute. The Personal Information Protection Law was adopted by the Standing Committee of the National People's Congress on 20 August 2021 and took effect on 1 November 2021, alongside the Data Security Law (effective 1 September 2021) and building on the Cybersecurity Law of 2017. Primary text: the National People's Congress publishes the Chinese text; the Wikipedia article summarises the provisions in English.

What it requires: a lawful basis and purpose limitation for processing personal information, with 'sensitive personal information', which explicitly includes medical health, biometric and genetic data and the data of minors under fourteen, requiring separate consent and a necessity justification; individual rights of access, correction and deletion; impact assessments; and, for cross-border transfers, a security assessment by the Cyberspace Administration of China, certification, or a standard contract, depending on volume and sensitivity, under measures issued in 2022 to 2024 that later eased the thresholds for lower-volume transfers. Critical information infrastructure operators and large processors must store data in China.

Why it matters for oncology and the arguments: multinational trials and genomic collaborations must now separate consent for research use, localise data and obtain approval before transferring identifiable patient data to sponsors abroad, on top of the separate Human Genetic Resources rules governing samples and genetic data. Foreign sponsors describe the layered approvals as a barrier that delays trial start-up and data cuts; Chinese regulators frame it as parity with the GDPR, on whose structure the law draws, though with far weaker limits on state access.