Compliance Guide — China
China Employee Monitoring Laws: PIPL, CSL, and Employer Compliance Guide 2026
China employee monitoring law is the set of data protection and cybersecurity regulations, including the Personal Information Protection Law (PIPL), Cybersecurity Law (CSL), and Data Security Law (DSL), that govern how employers may collect, process, and retain employee activity data for workers in mainland China. PIPL, effective November 2021, is the primary framework. It differs from GDPR in one critical way: employment alone does not substitute for consent when collecting sensitive personal information categories. This guide explains what global employers must change before deploying monitoring tools to China-based employees.
China's Employee Monitoring Legal Framework: PIPL, CSL, and DSL
China's employee monitoring legal framework rests on three interconnected statutes: the Personal Information Protection Law (PIPL, effective November 1, 2021), the Cybersecurity Law (CSL, effective June 2017), and the Data Security Law (DSL, effective September 2021). Each statute addresses different dimensions of how employers handle employee data, and compliance requires understanding how all three interact for monitoring activities specifically.
PIPL is the primary statute for employee monitoring compliance. It governs any organization that processes personal information of individuals located in mainland China, regardless of where the processing organization is headquartered. A US employer with 50 engineers in Shanghai is subject to PIPL for those engineers' monitoring data, even if all processing servers are located in the United States. PIPL applies extraterritorially to data processing activities that affect individuals in China.
The CSL governs cybersecurity obligations for network operators, which includes most employers who operate IT infrastructure in China. CSL requirements intersect with employee monitoring through obligations to protect network security, log system access for audit purposes, and cooperate with government security assessments. The DSL classifies data by security level and creates obligations for protecting "important data" and "core data" categories that may include certain employee monitoring records depending on industry.
What Counts as Employee Personal Information Under PIPL
PIPL defines personal information as any information relating to an identified or identifiable natural person. For employee monitoring purposes, this definition covers: employee name and identification numbers, computer activity logs linked to an employee account, application and URL usage records associated with an employee, screenshot images showing employee work, keystrokes associated with an employee account, email metadata and content where the employee is sender or recipient, and precise location data if location tracking is used.
PIPL further classifies certain data types as sensitive personal information (SPIl), which requires separate, explicit consent for processing regardless of the lawful basis used for other employee data. Sensitive personal information categories relevant to employee monitoring include biometric identification information (facial geometry, fingerprints, voiceprints), precise geographic location, health and medical information, private communication content (email body text, message content, call recordings), and financial account information.
PIPL's Consent and Lawful Basis Requirements: What Makes China Different
PIPL establishes six lawful bases for processing personal information: consent, contractual necessity, legal obligation, vital interests, public interest, and legitimate interests. The critical difference from GDPR is how PIPL applies these bases to employee monitoring, particularly through the employment relationship.
The Employment Contract Is Not Automatic Justification
Under GDPR Article 6(1)(b), employers commonly rely on performance of contract (the employment contract) as the lawful basis for processing employee data that is necessary to administer the employment relationship. PIPL's contractual necessity basis (Article 13(2)) has a narrower interpretation under current regulatory guidance: it covers only data processing that is strictly necessary to execute the specific terms of the employment contract, such as recording attendance for payroll purposes or processing bank details for salary payment.
Broader monitoring activities, including screen capture, application tracking, productivity scoring, and URL monitoring, go beyond what is strictly necessary to execute the employment contract itself. For these activities, employers must rely on either consent or legitimate interests. Consent is the safer and more common choice in practice, because China's legitimate interests framework is less developed and carries more regulatory uncertainty than GDPR's equivalent.
Consent Requirements Under PIPL
PIPL consent must be voluntary, specific, informed, and unambiguous. Embedding monitoring consent in an employment contract as a condition of employment raises questions about voluntariness, because employees have limited ability to negotiate employment terms. Chinese regulatory guidance suggests that the safest approach is to obtain separate, standalone consent for monitoring activities, distinct from the employment agreement, and to explain in clear language what will be monitored, for what purpose, and how data will be used and retained.
For sensitive personal information categories, PIPL requires separate explicit consent for each category. An employer who collects biometric data (such as facial recognition for timekeeping), precise location data (such as GPS tracking), and communications content (such as email monitoring) must obtain three separate consent agreements, one for each category, in addition to any general monitoring consent covering non-sensitive data.
Legitimate Interests Under PIPL
PIPL Article 13(6) allows processing under legitimate interests, but this basis requires demonstrating that the processing has a legitimate purpose, that the processing is necessary and proportionate to that purpose, and that the impact on individuals' rights and interests is limited. China has not yet published the same volume of regulatory guidance on legitimate interests balancing that the European Data Protection Board has produced for GDPR, making this basis less predictable. Most multinational employers operating in China default to consent-based processing for monitoring activities to avoid uncertainty.
High-Risk Monitoring Activities Under PIPL: What Creates the Most Exposure
Not all employee monitoring activities carry equal risk under PIPL. The highest-risk monitoring categories are those that involve sensitive personal information, cross-border data transfers, or large-scale processing operations that trigger government security assessment requirements.
Keystroke Logging and Communications Content Monitoring
Keystroke logging that captures the content of what employees type, including emails, messages, documents, and chat content, captures private communications content. PIPL classifies private communication content as sensitive personal information. Deploying keystroke logging tools that capture typed content in China requires separate explicit consent for this sensitive category. Keystroke logging tools that capture only statistics (characters per minute, active typing time) without capturing content are less problematic and may not trigger the sensitive information requirements.
Biometric Monitoring
Facial recognition timekeeping systems, fingerprint scanners, and voice recognition tools all collect biometric identification information, which is sensitive personal information under PIPL. Any employer deploying biometric-based monitoring or access control in China must obtain separate explicit consent from each employee before collecting biometric data, publish a biometric data retention and destruction schedule, and implement security measures appropriate to the sensitive nature of the data. PIPL does not impose a specific retention limit for biometric data, but the data minimization principle requires deletion when the purpose for collection has been fulfilled.
Location Tracking
Precise geographic location tracking of employees, whether through GPS in mobile devices, location-enabled productivity applications, or network-based location services, falls within PIPL's sensitive personal information category. Employers who track precise employee locations in China, including for field service management or attendance verification at specific locations, must obtain separate explicit consent for location data collection. General network-level location (city-level, not street-level) may not constitute "precise" location under PIPL, but this boundary has not been definitively resolved in regulatory guidance.
Screen Recording and Screenshot Monitoring
Periodic screenshot monitoring and screen recording do not automatically capture sensitive personal information in the way keystroke logging or biometric monitoring does. Screenshots of work activity on employer applications capture operational data that, under most employment contexts, falls within legitimate interests or contractual necessity. However, screenshots that routinely capture personal information visible on screen, such as employees accessing personal email, banking portals, or health portals during work hours, create incidental sensitive information collection that requires careful policy design to avoid PIPL exposure.
Cross-Border Data Transfer Requirements: China's Strictest Provision
China's cross-border data transfer requirements are among the most restrictive in the world, and they are the provision most frequently missed by multinational employers who assume that PIPL's substantive requirements are similar to GDPR and therefore their existing GDPR compliance program covers China. The cross-border transfer requirements are materially different and require separate compliance steps.
Three Available Transfer Mechanisms
PIPL Article 38 provides three mechanisms for transferring personal information from China to foreign countries. First, passing a government security assessment administered by the Cyberspace Administration of China (CAC), which is required for transfers by critical information infrastructure operators and for transfers that meet volume thresholds (100,000 individuals' data per year, or any transfer of 10,000 or more individuals' sensitive personal information). Second, obtaining personal information protection certification from a professional institution recognized by the CAC. Third, executing a standard contract for cross-border personal information transfer published by the CAC (the Chinese equivalent of GDPR standard contractual clauses, published in June 2022).
Most multinational employers with typical employee monitoring programs will qualify for the CAC standard contract mechanism unless their operation crosses the volume thresholds triggering mandatory security assessment. The CAC standard contract requires conducting a personal information protection impact assessment (PIPIA) and filing the contract and PIPIA with the local CAC within 10 business days after the contract takes effect.
Data Localization for Certain Industries
Critical information infrastructure operators, including employers in financial services, energy, transportation, and healthcare, face additional data localization requirements under both the CSL and PIPL. For these employers, certain categories of data collected in China must be stored within China and cannot be transferred abroad without completing the mandatory government security assessment first. An employer in financial services deploying a monitoring platform that stores data on overseas servers may need to complete a security assessment before any monitoring data leaves China, regardless of the volume thresholds that apply to general employers.