PIPL (Personal Information Protection Law)

The PIPL is China's overhaul of personal data protection rules. It mirrors GDPR's basic structure (lawful basis, data subject rights, data protection officers) but adds requirements specific to China — including national security review of cross-border data transfers, and restrictions on which jurisdictions personal data can be sent to. PIPL has extraterritorial reach: any service processing personal data of mainland-China residents falls within scope.

For offshore hosting, PIPL is most relevant to operators serving Chinese users from outside mainland China. Compliance generally requires a designated representative in China, plus documentation of data flows. Most offshore hosts target customers in non-China jurisdictions, where PIPL doesn't apply.