EXIN PIPL Foundation cheat sheet

The PIPL was adopted on 20 August 2021, took effect on 1 November 2021, and comprises 74 articles across eight chapters.

Personal information is any information relating to an identified or identifiable natural person, recorded electronically or otherwise, excluding anonymised information.

Sensitive personal information covers biometrics, religious belief, specific identity, medical health, financial accounts, whereabouts and any data of minors under 14.

Sensitive personal information additionally requires a specific purpose and strict necessity, separate consent, and a notification of necessity and impact on rights.

Processing means collection, storage, use, processing, transmission, provision, disclosure, deletion and any other handling of personal information.

The territorial scope covers processing inside the PRC and extraterritorial processing that serves the purpose of providing products or services to persons in the PRC or analysing or assessing their behaviour.

Extraterritorial processors must establish a dedicated entity or representative in the PRC and file with the competent authority; failure to comply can lead to listing and restricted data transfer.

A deceased person's relatives may exercise the rights of access, copying, correction and deletion for their own lawful and legitimate interests, unless the deceased arranged otherwise.

Anonymisation means processing so that the information cannot identify a specific natural person and cannot be restored; anonymised information falls outside the PIPL.

Consent is only one of seven legal bases; others include contract necessity, statutory duty, public health or emergency, news and public opinion supervision, and other laws.

Valid consent must be voluntary and explicit, given with full knowledge, and obtained through a prominent, clear and easily accessible notice.

Separate consent is required for processing sensitive personal information, providing information to third parties, public disclosure, and use for automated decision-making.

Consent must be re-obtained when the purpose, method or category of processed information changes; bundling consent with unrelated services is prohibited.

Withdrawal of consent must be as easy as giving it, and processing before withdrawal remains lawful; withdrawal does not affect prior acts.

Processing is permitted without consent for contract necessity, statutory duties, public health emergencies or protection of life and property, and lawful news reporting.

Where the legal basis depends on consent, the processor bears the burden of proving that consent was obtained and valid.

Processing of personal information by state organs must follow statutory powers and procedures and must not exceed the scope necessary for performing duties.

Where a law or regulation requires confidentiality for personal information processed by state organs, confidentiality obligations apply.

Individuals hold rights to know, decide, restrict or refuse processing, access and copy, correct or supplement, and delete their personal information.

A deletion request must be honoured where the purpose is achieved, the service is stopped, consent is withdrawn, or processing was unlawful or the agreement was breached.

If deletion is technically difficult, processing and storage must stop and the information be protected; the individual must be informed.

Access and copy requests are answered free of charge; charging for repeated requests beyond a reasonable limit is permitted only under published standards.

Requests must be handled within a reasonable period; refusal must state reasons, and the individual may complain to the authority or sue in court.

The right to explanation covers automated decision-making, and individuals may refuse decisions made solely by automated means that significantly affect their rights.

Requests must be verified to prevent identity theft, but the processor may not demand excessive verification data as a condition of handling.

The right to portability allows an individual to obtain their information in a structured, commonly used, machine-readable format and request transfer to another processor.

Relatives of a deceased person may request access, copying, correction or deletion for their own lawful and legitimate interests unless the deceased arranged otherwise.

Processors must adopt internal management systems, classify information, apply encryption and de-identification, and set operational procedures and emergency plans.

Where processing reaches the threshold set by the authority, a personal information protection officer must be appointed, with contact details filed with the authority.

A personal information protection impact assessment is required before processing sensitive information, automated decision-making, entrusting, providing to third parties or public disclosure.

The impact assessment report and handling records must be kept for at least three years.

Entrusted processing requires a written agreement on purpose, period, processing method and protection measures, and the entrusted party must process only as instructed.

Where a processor provides information to a third party, it must inform the individual of the recipient's name and contact details, purpose and method, and obtain separate consent.

Cross-border transfer requires a security assessment, certification by a professional body, or a standard contract filed with the authority, plus separate consent and notification.

Data breach response requires immediate remedial measures and notification to the authority and affected individuals, stating the cause, harm and remedies.

Where two or more processors jointly determine purpose and method, they agree on obligations and bear joint liability for harm caused.

The Cyberspace Administration of China is the principal regulator, with departments under the State Council and local governments performing related duties within their scope.

Penalties include ordering correction, warnings, confiscation of illegal gains, suspension of service, and fines up to RMB 50 million or 5% of the prior year's turnover.

Directly responsible personnel may be fined up to RMB 1 million and banned from holding relevant positions for a set period.

Serious violations may result in business suspension, revocation of licences, and a public listing of the violation in the social credit record.

Liability for harm follows fault-based presumption: the processor must prove it is not at fault, otherwise it bears compensation.

Where a violation causes harm to many individuals, the procuratorate or a designated consumer organisation may bring a public interest lawsuit.

A complaint or report may be filed with the authority, which must handle it within the statutory period and inform the complainant of the result.

Processors must cooperate with regulatory inspections and provide necessary information; refusal to cooperate is itself a violation.

Compliance governance requires documented policies, training, audit trails, and a designated officer where thresholds are met.