PIPL Data Localization

The Personal Information Protection Law (PIPL) of the People’s Republic of China took effect on November 1, 2021, and is the foundational law for personal information protection in China. Together with the Cybersecurity Law and the Data Security Law, PIPL forms China’s data governance legal framework. Violators can be fined up to RMB 50 million or 5% of the prior year’s turnover, and may have their business license revoked.

For the power and energy industry, as the power grid is critical information infrastructure, the electricity consumption behavior data, user identity information, and device location information collected by grid operators are all subject to PIPL. EnerOS supports grid operators in meeting PIPL requirements through regionalized deployment, data residency strategies, and personal information protection impact assessment capabilities.

Legal Overview

PIPL consists of eight chapters and 74 articles. Key points include:

Personal Information Definition

PIPL classifies personal information into two categories:

Note: Household-level electricity consumption behavior data may be classified as sensitive personal information (as it can infer family routines, whether at home, etc.), and separate consent must be obtained when processing.

Core Requirements and Implementation

Personal Information Processing Rules

Lawful Basis

Article 13 of PIPL stipulates seven lawful bases, each of which must be explicitly declared in EnerOS:

[data_flow.legal_basis]
allowed_values = [
    "consent",                  # Obtain individual consent
    "contract-performance",     # Necessary for concluding or performing a contract
    "legal-duty",              # Perform statutory duties or obligations
    "public-health-emergency", # Respond to public health emergencies
    "news-reporting",          # News reporting
    "public-interest",         # Public interest as stipulated by law
    "other-law"                # Other circumstances stipulated by law
]

Notice and Consent Flow

use eneros_privacy::consent::{ConsentRequest, ConsentScope};

let request = ConsentRequest::builder()
    .subject_id("user-12345")
    .purpose("Electricity consumption behavior analysis and load forecasting")
    .scope(ConsentScope::Sensitive)
    .legal_basis("consent")
    .retention_days(365 * 7)
    .withdraw_url("/consent/withdraw/user-12345")
    .language("zh-CN")
    .notice_text("To provide load forecasting service, we need to collect your electricity consumption data...")
    .build()?;

// Record consent status
let consent = request.execute().await?;
assert!(consent.is_granted());
assert_eq!(consent.scope(), ConsentScope::Sensitive);

Cross-border Transfer

Articles 38-40 of PIPL impose strict requirements on cross-border transfer of personal information:

Cross-border Policy Engine

use eneros_trust::region::{RegionPolicy, CrossBorderRequest};

let policy = RegionPolicy::new()
    .source_region("cn-east-1")
    .default_action("deny");

let request = CrossBorderRequest::builder()
    .source("cn-east-1")
    .destination("eu-west-1")
    .data_category("pii")
    .legal_basis("consent")
    .has_security_assessment(false)
    .build()?;

// Deny cross-border by default
let decision = policy.evaluate(&request).await?;
assert_eq!(decision.action, "deny");
assert_eq!(decision.reason, "Security assessment not passed");

EnerOS Compliance Implementation

1. Region-Independent Cluster Deployment

To meet the data localization requirements for critical information infrastructure operators, EnerOS recommends deploying independent clusters within China:

[deployment]
region = "cn-east-1"
country = "CN"
data_residency = "strict"            # Strict data residency
cross_border_policy = "deny-by-default"
sovereign_cloud = true               # Sovereign cloud mode

[deployment.localization]
database_in_region = true            # Database domestic
storage_in_region = true             # Object storage domestic
ca_in_region = true                  # CA domestic independent
key_in_region = true                 # Keys domestic escrow

[deployment.approvals]
cross_border_approver = "cip-officer@grid.cn"
security_assessment_required = true

2. Data Classification and Tagging

PIPL requires data processors to classify personal information. EnerOS implements this through field tagging:

[data.classification]
standard = "pipl"
enabled = true

[[data.fields]]
name = "customer_name"
pii = true
category = "general-identifier"      # General personal information
encryption = "AES-256-GCM"
retention_days = 2555

[[data.fields]]
name = "id_card_number"
pii = true
category = "sensitive"               # Sensitive personal information
encryption = "AES-256-GCM"
access_log = true                    # Access trail
separate_consent = true              # Separate consent

[[data.fields]]
name = "consumption_pattern"
pii = true
category = "sensitive"               # Electricity consumption may infer routines
encryption = "AES-256-GCM"
pseudonymization = true              # Pseudonymization

[[data.fields]]
name = "voltage_kv"
pii = false
category = "operational"
retention_days = 3650

3. Personal Information Protection Impact Assessment (PIA)

Articles 55-56 of PIPL require conducting personal information protection impact assessments in specific circumstances:

# Generate PIA assessment template
eneros-cli pia init --project "Smart Meter Data Collection Project" \
  --output pia-smart-meter-2026.md

# Auto-fill processing activity information
eneros-cli pia autofill --input pia-smart-meter-2026.md \
  --data-flow smart-meter-collection

# Submit for review
eneros-cli pia submit --input pia-smart-meter-2026.md \
  --reviewer cip-officer@grid.cn

# Export assessment report
eneros-cli pia export --id pia-2026-001 \
  --format pdf --output pia-2026-001.pdf

PIA assessments must be archived for at least 3 years (Article 56 requirement).

Data Classification

EnerOS classifies data into four levels per PIPL requirements:

Configuration Example

Complete PIPL Configuration in eneros.toml

[compliance]
standard = "pipl"
version = "2021"
enforce = true
protection_officer = "pip-officer@grid.cn"

[pipl]
enabled = true
data_residency = "strict"
cross_border_policy = "deny-by-default"
breach_notification_hours = 24        # Immediately report to CAC
default_retention_years = 7

# Personal information processor obligations
[pipl.obligations]
appoint_protection_officer = true     # Appoint data protection officer
conduct_annual_audit = true           # Annual compliance audit
security_protection_measures = true
training_required = true              # Employee training

# Consent management
[pipl.consent]
default_scope = "explicit"            # Explicit consent
separate_consent_for_sensitive = true # Separate consent for sensitive information
withdraw_mechanism = true             # Consent withdrawal mechanism
withdraw_url = "/consent/withdraw"

# Data subject rights
[pipl.rights]
response_days = 15                    # PIPL requires 15 business days
extension_days = 30
notice_language = "zh-CN"
channels = ["web", "mobile", "offline"]

# Cross-border transfer
[pipl.cross_border]
default_policy = "deny"
security_assessment_required = true
standard_contract_required = true
separate_consent_required = true
cac_notification_threshold = 1000000  # 1 million people threshold

# Data retention
[pipl.retention]
default_days = 2555                   # 7 years
sensitive_days = 1825                 # 5 years for sensitive information
auto_delete = true
notify_before_days = 30

# Processing records
[pipl.processing_records]
auto_generate = true
retain_years = 3                      # Article 56 requires at least 3 years
storage = "worm"

Rust Code: Compliance Check

use eneros_compliance::pipl::ComplianceChecker;

let checker = ComplianceChecker::new("eneros.toml")?;
let report = checker.check().await?;

for finding in &report.findings {
    match finding.severity {
        Severity::Critical => println!("Critical: {}", finding.description),
        Severity::High => println!("High: {}", finding.description),
        Severity::Medium => println!("Medium: {}", finding.description),
        Severity::Low => println!("Low: {}", finding.description),
    }
}

println!("Compliance score: {}/100", report.score);

Region Residency Configuration

[region]
id = "cn-east-1"
country = "CN"
data_residency = "strict"   # Reject any cross-border plaintext transmission
cross_border_policy = "deny-by-default"

[region.sovereign]
enabled = true
local_ca = "/etc/eneros/ca-cn.crt"
local_kms = "kms://cn-east-1"
local_dns = ".grid.cn"

// Cross-region access is denied by default by the policy engine
policy.deny(
    Subject::region("cn-east-1"),
    Action::Read,
    Resource::region("eu-west-1").data("pii")).await?;

Compliance Checklist

Confirm each item before deployment:

• Deploy an independent cn-region cluster with database and object storage located domestically
• Cross-border transfer policy denies by default, only allowed after explicit approval
• Appoint a personal information protection officer with public contact information
• Personal information processing purpose, method, and scope explicitly declared in eneros.toml
• Separate consent flow for sensitive personal information (such as electricity consumption behavior)
• Auto-delete data when retention period expires and record audit
• Annual personal information protection impact assessment (PIA) archived
• Immediately remediate and report to CAC when a leak occurs or may occur
• Processing activity records auto-generated and retained for ≥ 3 years
• Processing of information of minors under 14 requires guardian consent
• Automated decision-making provides explanation and opt-out channel
• Data subject requests responded to within 15 business days
• Entrusted processing signs agreements and records
• Separate consent obtained before providing to third parties
• Data localization for critical information infrastructure operators
• Cross-border transfer reaching 1 million people must be declared to CAC
• Employee annual training records archived
• Privacy policy clearly expressed in Chinese

Related Documentation

• GDPR Data Subject Rights
• CCPA Right to Know and opt-out
• Internationalization and Compliance
• Multi-region and Disaster Recovery