EXIN PIPL Foundation key terms

Any information relating to an identified or identifiable natural person, recorded electronically or otherwise, excluding anonymized information. Examples include names, ID numbers, biometric data, location, and account records.

The natural person to whom personal information relates and whose rights the law protects. Only living individuals can be subjects; organizations, deceased persons, and anonymized datasets fall outside this concept.

An organization or individual that independently determines the purpose and means of personal information processing. This is the core regulated entity that bears the main compliance obligations under the law.

Any operation performed on personal information, including collection, storage, use, processing, transmission, provision, disclosure, deletion, and other activities. The definition is intentionally broad to cover the full data lifecycle.

Personal information that, once leaked or misused, easily leads to harm to personal dignity or property safety. It includes biometric, religious belief, specific identity, medical health, financial account, and location tracking data, plus information of minors under fourteen.

Processing personal information so that it cannot identify a specific natural person and cannot be restored. Anonymized information is outside the law's scope, unlike de-identified information, which remains personal information.

Processing personal information so that it cannot identify a specific natural person without additional information. De-identified data remains personal information and stays subject to the law if it can be re-linked.

A distinct, standalone indication of agreement obtained for specific higher-risk processing activities, such as sensitive information, external provision, public disclosure, and cross-border transfer. It must be separated from general privacy notices rather than bundled into them.

A voluntary, explicit expression of intent by the subject, made with full knowledge, permitting processing of their personal information. Consent must be freely given and can be withdrawn at any time.

The subject's right to revoke previously given consent at any time. The processor must provide an easy withdrawal mechanism, and withdrawal does not affect the lawfulness of prior processing.

The grounds that make processing lawful, such as consent, contract necessity, statutory duty, public health emergencies, public interest reporting, and other laws. Processing without at least one basis is unlawful.

A legal basis allowing processing needed to conclude or perform a contract to which the subject is a party, or to conduct human resources management under lawful labor rules and collective contracts.

A legal basis permitting processing necessary to perform statutory duties or obligations, such as responding to lawful requests from regulators or complying with anti-money-laundering rules.

A legal basis allowing processing within a reasonable scope for news reporting or public opinion supervision in the public interest. Processing beyond a reasonable scope requires another basis such as consent.

The set of entitlements granted to personal information subjects, including rights to know, decide, access, copy, correct, delete, withdraw consent, and request explanation of processing rules.

The subject's right to be informed about how their information is processed and to decide whether and how it may be handled, including restricting or refusing processing, except where laws provide otherwise.

The subject's right to inspect and obtain a copy of their personal information from the processor. Requests must be handled promptly and without unreasonable obstruction.

The subject's right to have inaccurate or incomplete personal information corrected or supplemented. Processors must verify and update records upon a valid request.

The subject's right to require deletion of their information when the processing purpose is achieved, a service stops, consent is withdrawn, processing is unlawful, or another statutory condition applies.

The subject's right to demand an explanation of the processor's personal information processing rules. This supports transparency and accountability in automated and complex processing.

The subject's right to obtain their personal information in a structured, commonly used, machine-readable format and to request transfer to another processor meeting regulatory conditions.

Information of a deceased person that close relatives may access, copy, correct, or delete for their own lawful and legitimate interests, unless the deceased arranged otherwise before death.

The subject's avenue to report unlawful processing to the authorities, who must handle complaints promptly. Processors may also be required to accept and respond to complaints internally.

The duty to inform subjects, before processing, of the processor's identity, purposes, methods, categories, retention period, and how to exercise rights. Changes in purpose or method require re-notification.

Arrangement where a processor engages another party to handle personal information on its behalf. The processor must agree on purpose, period, and safeguards, and supervise the entrusted party, retaining liability.

Two or more processors jointly determining purpose and means of processing. They must agree on respective rights and obligations, and are jointly liable to the subject for harm caused.

Providing personal information to entities outside mainland China. It requires a legal gateway such as security assessment, certification, standard contract, or another permitted path, plus separate consent and impact assessment.

A prescribed contractual template filed with the regulator as a cross-border transfer mechanism. It must reflect the required clauses and be filed before the transfer begins.

A regulatory review required for certain cross-border transfers, such as large-volume transfers or data held by critical information infrastructure operators. It must be passed before transfer occurs.

A documented pre-processing assessment required for sensitive information, automated decision-making, entrusted or joint processing, external provision, public disclosure, and cross-border transfer. Records must be kept for at least three years.

Using computer programs to automatically analyze or evaluate personal information and make decisions. It must be transparent and fair, and users must be offered an option not targeting personal characteristics or a convenient refusal.

Information of children under fourteen, treated as sensitive personal information. Processing requires guardian consent and dedicated processing rules.

A designated individual responsible for supervising processing activities and compliance, required for processors exceeding a regulatory volume threshold. Contact details must be filed with the regulator.

The principle that processors must be able to demonstrate compliance through policies, records, training, and assessments. It underpins audits, documentation duties, and regulatory cooperation.

Government departments such as cyberspace, market regulation, and public security authorities that supervise processing, investigate violations, and impose penalties. They may conduct inspections and require corrective action.

Sanctions for violations, including warnings, fines, suspension, and business license revocation for serious breaches. Individuals directly responsible may also face fines and personal liability.

The principle that processing purposes, methods, and rules must be clear, open, and disclosed to subjects. It supports informed consent and the right to explanation.

The duty to notify the regulator and affected subjects promptly when a leak, tampering, or loss occurs. Notification must describe likely harm and remedial measures taken.