On 1st November 2021, the new Personal Information Protection Law (PIPL) of the People’s Republic of China enters into force. This law applies to all organisations doing business in China or targeting people in China and has significant compliance consequences similar to GDPR. The sanctions for both the organisations and any directly responsible personnel are alarming given the timeframe to achieve compliance.