Data Breach Blast Radius
github/awesome-copilot
Pre-breach impact analysis: inventories sensitive data (PII, PHI, PCI-DSS, credentials), traces data flows, scores exposure vectors, and produces a regulatory blast radius report with fine ranges…
Guides compliance with China's Personal Information Protection Law (PIPL, effective 1 November 2021).
Install China Pipl
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill china-pipl -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills china-pipl --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/privacy/china-pipl .claude/skills/china-pipl && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "china-pipl" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/china-pipl into .claude/skills/china-pipl/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "china-pipl", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/china-piplType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill china-pipl -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills china-pipl --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/privacy/china-pipl .agents/skills/china-pipl && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "china-pipl" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/china-pipl into .agents/skills/china-pipl/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "china-pipl", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill china-pipl -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills china-pipl --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/privacy/china-pipl .cursor/skills/china-pipl && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "china-pipl" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/china-pipl into .cursor/skills/china-pipl/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "china-pipl", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/mukul975/Privacy-Data-Protection-Skills.git --path skills/privacy/china-pipl--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill china-pipl -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills china-pipl --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/privacy/china-pipl .gemini/skills/china-pipl && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "china-pipl" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/china-pipl into .gemini/skills/china-pipl/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "china-pipl", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install mukul975/Privacy-Data-Protection-Skills china-piplInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill china-pipl -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/privacy/china-pipl .github/skills/china-pipl && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "china-pipl" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/china-pipl into .github/skills/china-pipl/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "china-pipl", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add mukul975/Privacy-Data-Protection-Skills --skill china-pipl -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install mukul975/Privacy-Data-Protection-Skills china-pipl --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/mukul975/Privacy-Data-Protection-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/privacy/china-pipl .opencode/skills/china-pipl && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "china-pipl" agent skill from https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/china-pipl into .opencode/skills/china-pipl/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "china-pipl", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
china-pipl- GitHub stars
- 301
- Token cost
- ~5k tokens
- SKILL.md length
- 2,382 words
- Files
- 5 (incl. scripts, references, assets)
- Skills in repo
- 280
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Guides compliance with China's Personal Information Protection Law (PIPL, effective 1 November 2021).
- Works in 3 steps: CAC Security Assessment (Art. 40; CAC… → Standard Contract for Cross-Border… → Personal Information Protection…
- Tasks that involve Privacy and GDPR
- SKILL.md covers Overview, Scope and Extraterritorial…, Lawful Bases for Processing… and Consent Framework, plus 7 more sections
- Runs Python scripts from its folder
What it does
China Pipl is an agent skill from mukul975/Privacy-Data-Protection-Skills. Guides compliance with China's Personal Information Protection Law (PIPL, effective 1 November 2021). Covers consent requirements, cross-border transfer mechanisms (CAC security assessment, standard contracts, certification), separate consent triggers, and critical information infrastructure obligations. Keywords: PIPL, China data protection, CAC security assessment, cross-border transfer, separate consent, CIIO.
Its SKILL.md is about 5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 7 other files, including scripts, reference files and assets (for example `assets/template.md`, `references/standards.md` and `references/workflows.md`).
It sits in Legal & Compliance, covering Privacy and GDPR and Security review. The repository describes itself as: 282+ structured privacy & data protection skills for AI agents. GDPR, CCPA, EU AI Act, HIPAA, LGPD, PIPL, DPDP Act. The licence is Apache-2.0.
When your agent uses it
- Tasks that involve Privacy and GDPR
- Tasks that involve Security review
Example prompts
- “Use the china-pipl skill to guide compliance with China's Personal Information Protection Law (PIPL, effective 1 November 2021)”
- “/china-pipl”
Requirements
- Python 3
Workflow steps
3 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit 9b2ef9e. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 1 file in scripts/ (Python), which the agent can run.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
China Pipl loads about 5k tokens when it runs, and up to ~9.3k if it reads all its reference files. Until then it costs about 107 tokens; SKILL.md has 2,382 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
SKILL.md
The full file from mukul975/Privacy-Data-Protection-Skills at commit 9b2ef9e, republished under its Apache-2.0 licence (© mukul975). 2,382 words, ~4,977 tokens.
Download SKILL.mdSave it as
.claude/skills/china-pipl/SKILL.md (or your agent's skills folder). This skill also uses 4 other files; get the full folder from GitHub.- name
- china-pipl
- description
- Guides compliance with China's Personal Information Protection Law (PIPL, effective 1 November 2021). Covers consent requirements, cross-border transfer mechanisms (CAC security assessment, standard contracts, certification), separate consent triggers, and critical information infrastructure obligations. Keywords: PIPL, China data protection, CAC security assessment, cross-border transfer, separate consent, CIIO.
- license
- Apache-2.0
- metadata.author
- mukul975
- metadata.version
- 1.0
- metadata.domain
- privacy
- metadata.subdomain
- global-privacy-regulations
- metadata.tags
- pipl, china-data-protection, cac-security-assessment, cross-border-transfer, ciio
China PIPL Compliance
Overview
The Personal Information Protection Law of the People's Republic of China (PIPL, 个人信息保护法) was adopted by the Standing Committee of the National People's Congress on 20 August 2021 and took effect on 1 November 2021. The PIPL is China's first comprehensive national personal information protection law, operating alongside the Cybersecurity Law (CSL, effective 1 June 2017) and the Data Security Law (DSL, effective 1 September 2021) to form China's data governance framework.
The Cyberspace Administration of China (CAC, 国家互联网信息办公室) is the primary regulator, with enforcement authority shared among the Ministry of Public Security, the Ministry of Industry and Information Technology (MIIT), and sector-specific regulators.
Scope and Extraterritorial Application
Territorial Scope (Art. 3)
The PIPL applies to:
- Processing of personal information of natural persons within the territory of the PRC (Art. 3(1))
- Processing conducted outside the PRC of personal information of natural persons within the PRC where the purpose is:
- Providing products or services to natural persons within the PRC (Art. 3(2)(i))
- Analysing or assessing the behaviour of natural persons within the PRC (Art. 3(2)(ii))
- Other circumstances provided by laws or administrative regulations (Art. 3(2)(iii))
Extraterritorial Compliance (Art. 53)
Overseas personal information processors falling under Art. 3(2) must:
- Establish a dedicated entity or designate a representative within the PRC to handle personal information protection matters
- Report the name and contact information of the entity or representative to the relevant CAC department
Zenith Global Enterprises implementation: Zenith has designated its Shanghai office (Zenith Global Logistics (Shanghai) Co., Ltd) as the PRC representative entity, with the local Data Protection Manager serving as the designated contact.
Lawful Bases for Processing (Art. 13)
| Basis | PIPL Article | Key Requirements |
|---|---|---|
| Consent | Art. 13(1) | Voluntary, explicit, informed; specific consent for sensitive PI, cross-border transfers, and public disclosure |
| Contract necessity | Art. 13(2) | Necessary to conclude or perform a contract to which the individual is a party, or for HR management per lawfully adopted labour rules |
| Statutory duty or obligation | Art. 13(3) | Necessary to fulfil statutory duties or obligations |
| Public health emergency | Art. 13(4) | Necessary to respond to public health emergencies or protect life/property in emergencies |
| Public interest activities | Art. 13(5) | Processing for news reporting, public opinion supervision, or other public interest activities within a reasonable scope |
| Processing within reasonable scope of lawfully disclosed PI | Art. 13(6) | Information already disclosed by the individual or through other lawful means |
| Other circumstances in laws/administrative regulations | Art. 13(7) | Catch-all provision for sector-specific legislation |
Key distinction from GDPR: The PIPL does not include a standalone legitimate interest basis. Art. 13(6) (processing lawfully disclosed information) is the closest analogue but far narrower in scope.
Consent Framework
General Consent Requirements (Arts. 14-16)
| Requirement | PIPL Provision | Implementation |
|---|---|---|
| Voluntariness | Art. 14 | Consent must not be obtained through deception, coercion, or inducement; services may not be refused solely for withholding consent unless PI is necessary for the service |
| Informedness | Art. 14 | Individuals must be fully informed before consenting; information provided per Art. 17 |
| Explicitness | Art. 14 | Clear affirmative action required; pre-ticked boxes or bundled consent are non-compliant |
| Withdrawal | Art. 15 | Individuals have the right to withdraw consent; processors must provide convenient withdrawal mechanisms; withdrawal does not affect prior lawful processing |
| Separate consent | Arts. 23, 25, 26, 29, 39 | Required for specific high-risk processing scenarios (see below) |
Separate Consent Triggers (单独同意)
The PIPL requires separate consent (单独同意, dāndú tóngyì) — consent obtained independently from other consent collection — for the following processing activities:
| Trigger | Article | Context |
|---|---|---|
| Provision of PI to other processors | Art. 23 | When a processor provides personal information to another processor |
| Public disclosure of PI | Art. 25 | When a processor publicly discloses personal information |
| Processing images/personal identification from public surveillance | Art. 26 | Use of images or personal identification information collected via public places for purposes other than public safety |
| Processing sensitive personal information | Art. 29 | All processing of sensitive PI requires separate consent plus disclosure of necessity and impact |
| Cross-border transfer of PI | Art. 39 | International transfer requires separate consent with specified disclosures |
Zenith Global Enterprises implementation:
- Consent management platform configured with separate consent flows for each trigger scenario
- Customer onboarding includes distinct consent checkboxes for: (a) primary service processing, (b) data sharing with logistics partners, (c) cross-border transfer to headquarters, (d) credit assessment (sensitive PI)
- Employee consent flows include separate consent for: (a) employment data cross-border transfer, (b) background check (sensitive PI)
Sensitive Personal Information (Art. 28)
Definition
Sensitive personal information (敏感个人信息) is personal information that, once leaked or illegally used, may easily lead to infringement of the dignity of natural persons or harm to their personal or property safety. It includes:
- Biometric information
- Religious beliefs
- Specific identity information (including ID numbers)
- Medical and health information
- Financial account information
- Location tracking information
- Personal information of minors under 14 years of age
Processing Requirements (Arts. 28-32)
| Requirement | Detail |
|---|---|
| Separate consent | Art. 29: Separate consent required; written consent where required by laws/regulations |
| Necessity justification | Art. 28: Must have a specific purpose and sufficient necessity |
| Impact assessment | Art. 55: Personal information protection impact assessment (PIPIA) required before processing |
| Notification | Art. 30: Notify the individual of the necessity and impact on rights; for minors under 14, obtain consent from parent/guardian |
| Retention minimisation | Art. 28: Adopt strict protection measures; minimise retention period |
Zenith Global Enterprises Sensitive PI Register
| Data Type | Classification | Purpose | Consent Type | PIPIA Reference |
|---|---|---|---|---|
| National ID numbers (身份证号) | Specific identity | Customs clearance identity verification | Separate written consent | PIPIA-CN-001 |
| Financial account information | Financial | Payment processing for freight charges | Separate consent | PIPIA-CN-002 |
| Employee health certificates | Medical/health | Occupational safety compliance | Separate consent | PIPIA-CN-003 |
| GPS tracking of delivery vehicles | Location tracking | Real-time shipment tracking for customers | Separate consent (drivers) | PIPIA-CN-004 |
Cross-Border Transfer Mechanisms (Arts. 38-43)
Three Mandatory Mechanisms
The PIPL provides three primary mechanisms for transferring personal information outside the PRC, applicable based on the processor's scale and nature:
1. CAC Security Assessment (Art. 40; CAC Measures effective 1 September 2022)
When required (mandatory for any of the following):
- Critical information infrastructure operators (CIIOs) transferring any personal information abroad
- Processors that process personal information of 1 million or more individuals
- Processors that have cumulatively transferred personal information of 100,000 or more individuals abroad since 1 January of the preceding year
- Processors that have cumulatively transferred sensitive personal information of 10,000 or more individuals abroad since 1 January of the preceding year
Process:
- Conduct a self-assessment (personal information protection impact assessment)
- Submit the application to the CAC through the provincial-level CAC office
- CAC completes the assessment within 45 working days (extendable by another 15 working days for complex cases)
- Assessment valid for 2 years from the date of the assessment result, renewable upon expiry
Zenith Global Enterprises status: As Zenith processes personal information of over 100,000 customers and employees in China, and has transferred personal information of more than 100,000 individuals abroad cumulatively, the CAC security assessment is the mandatory transfer mechanism.
2. Standard Contract for Cross-Border Transfer (Art. 38(2); CAC Measures effective 1 June 2023)
When applicable (must meet all conditions):
- The processor is not a CIIO
- The processor processes personal information of fewer than 1 million individuals
- Cumulative cross-border transfer of fewer than 100,000 individuals' personal information since 1 January of the preceding year
- Cumulative cross-border transfer of fewer than 10,000 individuals' sensitive personal information since 1 January of the preceding year
Process:
- Conduct a personal information protection impact assessment
- Execute the CAC-published standard contract with the overseas recipient
- File the executed contract with the provincial-level CAC office within 10 working days of effectiveness
Standard contract key provisions:
- Purpose, scope, and method of processing by the overseas recipient
- Overseas recipient's obligations regarding data protection
- Individual rights protection mechanisms
- Remedies and liability allocation
- Termination conditions
3. Personal Information Protection Certification (Art. 38(3); TC260 Specification effective November 2022)
When applicable:
- Cross-border transfers within a multinational group or between entities subject to the same PI protection policies
- Processors that meet the standard contract thresholds
Process:
- The processor and overseas recipient jointly apply to an accredited certification body
- Certification body evaluates compliance with the TC260 Specification for Cross-Border Processing Activities
- Certification valid for 3 years with annual supervision audits
- Both parties must accept supervision by the certification body and the CAC
CAC Relaxation Measures (March 2024)
The CAC issued the Provisions on Facilitating and Regulating Cross-Border Data Flows (effective 22 March 2024), which introduced exemptions:
| Exemption | Condition |
|---|---|
| Contract/HR necessity | Cross-border transfer necessary for concluding/performing a contract to which the individual is a party, or for HR management under lawfully adopted labour rules |
| Small volume | Processor expects to transfer personal information of fewer than 100,000 individuals (excluding sensitive PI) abroad within one year |
| Free trade zones | Transfers from designated free trade zones subject to the negative list of that zone |
Important: These exemptions do not apply to CIIOs, transfers of important data, or transfers exceeding the specified thresholds.
Show full SKILL.md (917 more words)Show less
Zenith Global Enterprises Cross-Border Transfer Register
| Transfer ID | Flow | Destination | Mechanism | Volume | Assessment Status |
|---|---|---|---|---|---|
| CBT-CN-001 | Customer logistics data → EU HQ | Germany | CAC Security Assessment | 150,000+ individuals | Approved (valid until August 2026) |
| CBT-CN-002 | Employee HR data → Regional HR | Singapore | CAC Security Assessment | 2,500 employees | Approved (valid until August 2026) |
| CBT-CN-003 | Vendor payment data → Treasury | United Kingdom | Standard Contract (filed) | 800 vendors | Filed with Shanghai CAC |
| CBT-CN-004 | Shipment tracking data → API partners | Japan | Contract necessity exemption | 50,000 individuals | Exemption documented |
Critical Information Infrastructure (CII)
CIIO Obligations Under PIPL
Critical information infrastructure operators (关键信息基础设施运营者, CIIOs) face additional obligations:
| Obligation | Legal Basis | Detail |
|---|---|---|
| Data localisation | Art. 40 | Personal information and important data collected/generated during operations within the PRC must be stored domestically |
| Security assessment for export | Art. 40 | Mandatory CAC security assessment for any cross-border transfer (no alternative mechanisms) |
| Annual security assessment | CSL Art. 38 | Annual network security assessment and submission of assessment reports |
| Data security officer | DSL Art. 27 | Designate a data security responsible person |
CII Sector Identification
The following sectors are designated as CII under the Critical Information Infrastructure Security Protection Regulations (effective 1 September 2021):
- Public communications and information services
- Energy
- Transportation
- Water conservancy
- Finance
- Public services
- E-government
- National defence science and industry
- Other important network facilities and information systems that may endanger national security, people's livelihood, or the public interest if damaged
Zenith Global Enterprises assessment: As a logistics company, Zenith may be designated as CII under the transportation sector if its systems are determined to endanger national security or the public interest if damaged. Zenith maintains ongoing dialogue with the relevant sector authority (Ministry of Transport) regarding CII designation status.
Personal Information Protection Impact Assessment (PIPIA)
Mandatory PIPIA Triggers (Art. 55)
| Trigger | Description |
|---|---|
| Processing sensitive personal information | Any processing of sensitive PI (Art. 28) |
| Automated decision-making | Using personal information for automated decisions (Art. 24) |
| Entrusted processing | Entrusting a third party to process personal information (Art. 21) |
| Cross-border transfer | Providing personal information to overseas parties (Art. 38) |
| Public disclosure | Publicly disclosing personal information (Art. 25) |
| Other high-impact processing | Processing that has a significant impact on individual rights |
PIPIA Contents (Art. 56)
| Element | Description |
|---|---|
| Legality and legitimacy | Whether the processing purpose, method, and scope are lawful, legitimate, and necessary |
| Impact assessment | Assessment of the impact on individual rights and interests and the level of risk |
| Security measures | Whether the protective measures adopted are lawful, effective, and proportionate to the risk |
| Risk mitigation | Identification of risks and proposed mitigation measures |
PIPIA Retention
The PIPIA report and processing records must be retained for at least 3 years (Art. 56).
Individual Rights (Arts. 44-50)
| Right | Article | Implementation at Zenith Global Enterprises |
|---|---|---|
| Right to know and to decide | Art. 44 | Privacy notice in Simplified Chinese on all collection points |
| Right to restrict or refuse processing | Art. 44 | Opt-out mechanisms in customer portal; employee objection procedure |
| Right to access and copy | Art. 45 | Self-service data export from customer account; employee requests through HR |
| Right to portability | Art. 45(3) | Structured export to designated recipient (per CAC implementation rules when issued) |
| Right to correction and supplementation | Art. 46 | Self-service correction in customer portal; HR system for employees |
| Right to deletion | Art. 47 | Automated deletion workflows triggered by: purpose fulfilment, consent withdrawal, service termination, processing violation |
| Right to explanation | Art. 48 | Individuals may request explanation of PI processing rules; processor must provide timely response |
| Right regarding automated decision-making | Art. 24 | Right to request explanation of automated decisions; right to refuse decisions made solely through automated means |
| Right of deceased persons' relatives | Art. 49 | Close relatives may exercise rights of deceased individuals unless deceased arranged otherwise |
Enforcement Framework
Administrative Penalties (Arts. 66-69)
| Violation Level | Organisation Penalty | Individual Penalty (directly responsible person) |
|---|---|---|
| General violations | Order to rectify; warning; confiscation of unlawful income; suspension or termination of related application; fine up to RMB 1 million | Fine of RMB 10,000–100,000 |
| Serious violations | Order to rectify; confiscation of unlawful income; fine up to RMB 50 million or up to 5% of previous year's revenue; suspension of business; revocation of business licence | Fine of RMB 100,000–1,000,000; prohibition from serving as director, supervisor, senior manager, or DPO for a specified period |
Enforcement Actions
Didi Global CAC Investigation (2021-2022):
- CAC launched a cybersecurity review of Didi Chuxing following its NYSE IPO in June 2021
- Didi was found to have committed 16 violations of the CSL, DSL, and PIPL
- Final penalty (July 2022): RMB 8.026 billion fine (approximately USD 1.2 billion), plus personal fines of RMB 1 million each on CEO and President
- Significance: Largest data protection fine in China; demonstrated integration of PIPL, CSL, and DSL enforcement
SAMR/CAC App Compliance Campaigns (2021-2025):
- Regular enforcement campaigns targeting mobile applications for excessive data collection, bundled consent, and failure to provide deletion mechanisms
- Thousands of apps removed from app stores or required to remediate
- Zenith Global Enterprises app compliance: Annual audit by external firm; remediation within 15 days of any finding
Compliance Programme Structure
| Component | Detail |
|---|---|
| PRC representative entity | Zenith Global Logistics (Shanghai) Co., Ltd |
| Data Protection Manager (China) | Li Wei, Director of Information Security, Shanghai office |
| PIPIA programme | Mandatory PIPIA for all triggers under Art. 55; retained for minimum 3 years |
| Cross-border transfer compliance | CAC Security Assessment approved for primary data flows; standard contracts filed for lower-volume flows |
| Consent management | Platform configured for general and separate consent per Arts. 14, 23, 25, 29, 39 |
| Training | Annual PIPL compliance training for all PRC employees; quarterly refreshers for data handling roles |
| Incident response | 72-hour notification to CAC for incidents affecting PI security; coordinated with headquarters incident response team |
© mukul975, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 4 other files (scripts, references, assets) in skills/privacy/china-pipl of mukul975/Privacy-Data-Protection-Skills.
- SKILL.md
- assets/template.md
- references/standards.md
- references/workflows.md
- scripts/process.py
Open the folder on GitHubat commit 9b2ef9e
Compare with similar skills
China Pipl next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| China Pipl this skillmukul975/Privacy-Data-Protection-Skills | 301 | — | ~5k | Automated safety check: Pass | Apache-2.0 | |
| Data Breach Blast Radiusgithub/awesome-copilot | 40k | 1 repos | ~3.6k | Automated safety check: Notes | MIT | |
| Cursor Compliance Auditjeremylongshore/tons-of-skills-marketplace | 2.8k | — | ~2.3k | Automated safety check: Notes | MIT | |
| Juicebox Security Basicsjeremylongshore/tons-of-skills-marketplace | 2.8k | — | ~1.3k | Automated safety check: Pass | MIT | |
| Fondo Security Basicsjeremylongshore/tons-of-skills-marketplace | 2.8k | — | ~1.2k | Automated safety check: Pass | MIT | |
| C15tc15t/c15t | 1.9k | 1 repos | ~1.6k | Automated safety check: Pass | Apache-2.0 |
Similar skills
- Official
Cursor Compliance Audit
jeremylongshore/tons-of-skills-marketplace
Compliance and security auditing for Cursor IDE usage: SOC 2, GDPR, HIPAA assessment, evidence collection, and remediation.
Juicebox Security Basics
jeremylongshore/tons-of-skills-marketplace
Apply Juicebox security best practices. An agent skill from jeremylongshore/tons-of-skills-marketplace.
Fondo Security Basics
jeremylongshore/tons-of-skills-marketplace
Apply security best practices for Fondo including OAuth token management, financial data protection, SOC 2 compliance, and access control.
C15t
c15t/c15t
Work with c15t consent management docs, APIs, and integrations for Next.js, React, and JavaScript.
HIPAA Safe Harbor Coverage Audit
maziyarpanahi/openmed
Checks OpenMed de-identified clinical text against the 18 HIPAA Safe Harbor identifier categories and reports gaps and residual re-identification risk.
More from mukul975/Privacy-Data-Protection-Skills
All 280 skills in this repoAge Gating Services
mukul975/Privacy-Data-Protection-Skills
Implements age-gating mechanisms for online services to restrict access based on user age.
AI Data Retention
mukul975/Privacy-Data-Protection-Skills
Manages AI model retention and machine unlearning requirements.
AI Dpia
mukul975/Privacy-Data-Protection-Skills
Conducts Data Protection Impact Assessments for AI and ML systems per EDPB Guidelines 04/2025 on AI processing.
Dpia Mitigation Plan
mukul975/Privacy-Data-Protection-Skills
Structures risk mitigation planning and residual risk tracking for Data Protection Impact Assessments under GDPR Article 35(7)(d).
Gdpr Accountability
mukul975/Privacy-Data-Protection-Skills
Guides implementation of the GDPR accountability principle under Articles 5(2) and 24, including documentation requirements for policies, DPIAs, RoPA, training records, and breach logs.
Pia Threshold Screening
mukul975/Privacy-Data-Protection-Skills
Conducts pre-DPIA threshold screening to determine whether a full Data Protection Impact Assessment is required under GDPR Article 35.
Related
Categories
Questions about China Pipl
What does China Pipl do?
Guides compliance with China's Personal Information Protection Law (PIPL, effective 1 November 2021). China Pipl is an agent skill from mukul975/Privacy-Data-Protection-Skills. Guides compliance with China's Personal Information Protection Law (PIPL, effective 1 November 2021).
When should I use China Pipl?
China Pipl fits situations like: tasks that involve Privacy and GDPR; tasks that involve Security review.
How do I install China Pipl in Claude Code?
Run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill china-pipl -a claude-code`. Or copy the skill folder (skills/privacy/china-pipl in mukul975/Privacy-Data-Protection-Skills) into .claude/skills/china-pipl in your project. Claude Code loads it when a task matches its description.
How do I install China Pipl in Codex?
Run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill china-pipl -a codex`. Or copy the skill folder (skills/privacy/china-pipl in mukul975/Privacy-Data-Protection-Skills) into .agents/skills/china-pipl in your project. Codex loads it when a task matches its description.
Can I use China Pipl in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add mukul975/Privacy-Data-Protection-Skills --skill china-pipl -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/china-pipl, .gemini/skills/china-pipl, .github/skills/china-pipl and .opencode/skills/china-pipl in your project.
What does China Pipl need to run?
Going by SKILL.md and its folder, China Pipl needs Python for the scripts in its folder. Our summary lists: Python 3.
Does China Pipl access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is China Pipl safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
What licence does China Pipl use?
China Pipl is published under the Apache-2.0 licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does China Pipl use?
About 5k tokens (SKILL.md is roughly 20k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 4.4k tokens, read only when the agent opens those files.
What are the alternatives to China Pipl?
Skills that share tags, products or a category with China Pipl: Data Breach Blast Radius (github/awesome-copilot, 40k stars), Cursor Compliance Audit (jeremylongshore/tons-of-skills-marketplace, 2.8k stars), Juicebox Security Basics (jeremylongshore/tons-of-skills-marketplace, 2.8k stars) and Fondo Security Basics (jeremylongshore/tons-of-skills-marketplace, 2.8k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains China Pipl?
mukul975 (a GitHub user) maintains it in mukul975/Privacy-Data-Protection-Skills, which has 301 GitHub stars. The repository holds 280 skills in this directory. The repository was last updated on March 16, 2026.
Source: mukul975/Privacy-Data-Protection-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.