I85PREP
⌘ K
EXIN PIPL Foundation study materials
EXIN PIPL Foundation study resources

EXIN PIPL Foundation practice questions

One question at a time. Build your EXIN PIPL Foundation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Scope, definitions and basic concepts of the PRC Personal Information Protection Law

According to the PRC Personal Information Protection Law (PIPL), which statement best describes the relationship between the law and the processing of personal information by state organs?

  1. State organs are covered only when they purchase services from private companies.
  2. State organs must comply with PIPL when processing personal information, with a dedicated chapter governing their processing activities. Correct answer.
  3. State organs are governed exclusively by the Civil Code and never by PIPL.
  4. State organs are entirely exempt from PIPL because they act in a public capacity.

Explanation

PIPL applies broadly to processing activities carried out within the territory of the PRC, and it contains a dedicated chapter (Chapter 3, Section 2) addressing the special rules for state organs processing personal information. State organs are therefore bound by the law rather than exempt from it.

Question 2Scope, definitions and basic concepts of the PRC Personal Information Protection Law

PIPL's territorial scope is primarily based on where the processing activity occurs. Which additional rule extends the law's reach beyond the territory of the PRC?

  1. Processing of personal information of natural persons located in the PRC from outside the PRC for the purpose of providing products or services to them. Correct answer.
  2. Processing of any data relating to a Chinese company's overseas branch regardless of purpose.
  3. Processing of publicly available information that happens to mention China.
  4. Processing by foreign companies of information about their own overseas employees.

Explanation

Article 3 extends extraterritorial application where personal information of natural persons in the PRC is processed from outside the territory for the purpose of providing products or services to persons in the PRC, or for analyzing or evaluating behavior of persons in the PRC. The key link is the targeting of individuals located in China.

Question 3Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Under PIPL, personal information is defined as information related to an identified or identifiable natural person, excluding information that has been anonymized. What does this exclusion imply?

  1. Anonymized information falls outside PIPL's definition of personal information. Correct answer.
  2. Anonymized information is treated as sensitive personal information.
  3. Anonymized information can never be used commercially.
  4. Anonymized information remains personal information but with lighter duties.

Explanation

Article 4 states that personal information does not include information that has been anonymized. Anonymization is therefore the dividing line that removes information from PIPL's personal-information regime, provided the anonymization is genuinely irreversible.

Question 4Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Which of the following best captures the statutory meaning of 'processing' of personal information under PIPL?

  1. Only automated processing carried out by information systems.
  2. Only the use and disclosure of personal information.
  3. Only the collection and storage of personal information.
  4. Collection, storage, use, processing, transmission, provision, disclosure, deletion and other activities. Correct answer.

Explanation

Article 4 defines processing broadly to cover collection, storage, use, processing, transmission, provision, disclosure, deletion and any other handling of personal information. This broad definition means nearly every lifecycle activity involving personal information is captured.

Question 5Scope, definitions and basic concepts of the PRC Personal Information Protection Law

PIPL distinguishes 'sensitive personal information' from ordinary personal information. Which item is expressly listed in PIPL as sensitive personal information?

  1. A person's office telephone extension number.
  2. Biometric characteristics, religious belief, specific identity, medical health, financial accounts, and location tracking. Correct answer.
  3. A product's serial number in a warehouse database.
  4. A company's registered business address.

Explanation

Article 28 lists sensitive personal information as including biometric characteristics, religious belief, specific identity, medical health, financial accounts, and location tracking, as well as personal information of minors under 14. This category triggers stricter consent and impact assessment obligations.

Question 6Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Under PIPL, personal information of minors under what age is treated as sensitive personal information, requiring consent from the minor's parents or other guardians?

  1. Under 12 years of age.
  2. Under 16 years of age.
  3. Under 18 years of age.
  4. Under 14 years of age. Correct answer.

Explanation

Article 31 treats personal information of minors under 14 as sensitive personal information and requires consent from parents or other guardians. The processor must also adopt special processing rules for such information.

Question 7Scope, definitions and basic concepts of the PRC Personal Information Protection Law

A company collects personal information from users in the PRC and stores it on servers located in Singapore. Under PIPL, which concept describes the transfer of this information from within the PRC to the overseas servers?

  1. Anonymization.
  2. Domestic processing only, since the company is foreign.
  3. Cross-border provision of personal information. Correct answer.
  4. Public disclosure.

Explanation

PIPL governs the cross-border provision of personal information, meaning the transfer of personal information processed within the PRC to recipients outside the PRC. Such transfers trigger specific conditions such as security assessment, certification, or standard contractual clauses.

Question 8Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Which term describes a natural or legal person that independently determines the purpose and means of processing personal information under PIPL?

  1. Entrusted party.
  2. Supervisory authority.
  3. Personal information processor. Correct answer.
  4. Data subject.

Explanation

PIPL uses 'personal information processor' to refer to the entity that independently decides the purpose and means of processing. The processor bears the primary compliance obligations under the law.

Question 9Scope, definitions and basic concepts of the PRC Personal Information Protection Law

When one organization entrusts another with processing personal information on its behalf, how does PIPL allocate responsibility?

  1. Both parties become joint controllers with identical statutory duties.
  2. The entrusting party remains the processor and must supervise the entrusted party through an agreement. Correct answer.
  3. The entrusted party becomes the sole processor and the entrusting party is released from all duties.
  4. The entrusted party is treated as a data subject.

Explanation

Under Article 21, where a processor entrusts processing to another party, the entrusting processor remains responsible and must agree with the entrusted party on processing purpose, period, method, information types, and protection measures, and must supervise performance.

Question 10Scope, definitions and basic concepts of the PRC Personal Information Protection Law

PIPL lists several legal bases for processing personal information. Which of the following is one of those statutory bases?

  1. Processing is requested informally by a business partner.
  2. Processing could increase the processor's revenue.
  3. Processing is necessary to conclude or perform a contract to which the individual is a party. Correct answer.
  4. Processing is convenient for the processor's marketing strategy.

Explanation

Article 13 lists grounds including consent, necessity for concluding or performing a contract with the individual, performance of statutory duties, response to public health emergencies, and other specified situations. Commercial convenience is not among the legal bases.

Question 11Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Under PIPL, when consent is used as the basis for processing personal information, what quality must that consent have?

  1. Consent implied by the individual's failure to object.
  2. Consent obtained after the processing has already begun.
  3. Consent that is voluntary, explicit, and informed, given by the individual. Correct answer.
  4. Consent given implicitly through continued use of a service.

Explanation

Article 14 requires consent to be given voluntarily and explicitly on the basis of full information. Where the purpose, method, or type of information changes, fresh consent must be obtained.

Question 12Scope, definitions and basic concepts of the PRC Personal Information Protection Law

A processor wishes to use personal information for a purpose not covered by the original consent. What does PIPL require?

  1. Nothing, because the individual already consented once.
  2. The processor must notify only the supervisory authority.
  3. The processor must delete all prior data first.
  4. The processor must obtain fresh consent for the new purpose. Correct answer.

Explanation

Article 14 provides that where the purpose, method, or type of personal information to be processed changes, the processor must obtain consent anew. A prior consent does not extend to materially different uses.

Question 13Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Which principle in PIPL requires that personal information be collected for a clear and reasonable purpose and be limited to the minimum scope necessary?

  1. The principle of data maximization.
  2. The principle of unrestricted sharing.
  3. The principle of perpetual retention.
  4. The principle of data minimization and purpose limitation. Correct answer.

Explanation

Article 6 requires processing to have a clear and reasonable purpose, to be directly related to that purpose, and to use the least intrusive method with the minimum scope of personal information necessary. This reflects purpose limitation and minimization.

Question 14Scope, definitions and basic concepts of the PRC Personal Information Protection Law

PIPL requires that personal information be kept for the shortest period necessary to achieve the processing purpose, unless otherwise provided by law. Which obligation follows from this retention principle?

  1. Processors must delete or anonymize personal information once the retention period expires. Correct answer.
  2. Processors must retain all information for at least ten years.
  3. Processors may retain information indefinitely as long as it is encrypted.
  4. Processors must transfer expired data to the regulator.

Explanation

Article 47 requires deletion when the processing purpose is achieved, the service ceases, consent is withdrawn, or the retention period expires, unless retention is required by law. Anonymization is an alternative where deletion is technically difficult.

Question 15Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Which individual right under PIPL allows a person to request an explanation of the processing rules from the personal information processor?

  1. The right to portability.
  2. The right to compensation only.
  3. The right to know and the right to decide, including requesting explanation of processing rules. Correct answer.
  4. The right to remain anonymous in all transactions.

Explanation

Article 44 grants the right to know and the right to decide regarding the processing of one's personal information, and Article 48 allows the individual to request an explanation of the processing rules. These rights underpin individual control over personal information.

Question 16Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Under PIPL, an individual may withdraw consent previously given for processing. What is the effect of withdrawal?

  1. The processor must stop processing based on that consent, though processing based on other legal bases may continue. Correct answer.
  2. Withdrawal is not permitted once consent is given.
  3. Withdrawal automatically deletes all information held by the processor.
  4. Withdrawal requires approval from the supervisory authority.

Explanation

Article 15 allows withdrawal of consent, and the processor must cease processing based on that consent. Withdrawal does not affect processing that has another legal basis, nor does it automatically require deletion of all data.

Question 17Scope, definitions and basic concepts of the PRC Personal Information Protection Law

PIPL imposes duties on large internet platform service providers. What additional obligation is placed on personal information processors providing important internet platform services with a large number of users?

  1. They must obtain consent from every user each day.
  2. They must transfer all data to the government.
  3. They must establish an independent body composed mainly of external members to supervise personal information protection. Correct answer.
  4. They must stop all processing of personal information.

Explanation

Article 58 requires important internet platform service providers with a large number of users to establish a sound personal information protection compliance system, set up an independent oversight body mainly composed of external members, and publish social responsibility reports, among other duties.

Question 18Scope, definitions and basic concepts of the PRC Personal Information Protection Law

A processor intends to process sensitive personal information. Which additional requirement applies under PIPL?

  1. No consent is ever required for sensitive information.
  2. Only ordinary consent is required, identical to ordinary information.
  3. Specific consent is required, and where the law requires, a separate consent must be obtained. Correct answer.
  4. Consent may be replaced by a privacy notice posted on the website.

Explanation

Article 29 requires specific consent for processing sensitive personal information, and where laws or administrative regulations require separate consent, that separate consent must be obtained. Article 30 further requires notification of the necessity and impact on the individual's rights.

Question 19Scope, definitions and basic concepts of the PRC Personal Information Protection Law

PIPL requires a personal information protection impact assessment in certain situations. Which situation triggers such an assessment?

  1. Sending an internal memo that contains no personal information.
  2. Processing sensitive personal information. Correct answer.
  3. Processing personal information to fulfill a contract with the individual.
  4. Storing ordinary contact details of a single business client.

Explanation

Article 55 requires a personal information protection impact assessment for processing sensitive personal information, automated decision-making, entrusting or providing information to others, public disclosure, cross-border transfers, and other activities with significant impact. The assessment must be documented.

Question 20Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Under PIPL, which statement accurately describes the law's relationship to the Civil Code's personality rights provisions?

  1. PIPL applies only to criminal matters and the Civil Code to all other matters.
  2. PIPL replaces the Civil Code entirely on privacy matters.
  3. PIPL and the Civil Code operate together, with PIPL providing specialized rules on personal information protection. Correct answer.
  4. PIPL has no relationship to the Civil Code.

Explanation

PIPL is a specialized law on personal information protection that complements the Civil Code's personality rights chapter, which also addresses privacy and personal information. The two operate together rather than one replacing the other.

Question 21Scope, definitions and basic concepts of the PRC Personal Information Protection Law

A foreign company with no establishment in the PRC processes personal information of individuals in the PRC to analyze their behavior. What does PIPL require of such an offshore processor?

  1. It must obtain a license from its home country only.
  2. Nothing, because the company is outside the PRC.
  3. It must stop processing information about PRC individuals entirely.
  4. It must establish a dedicated entity or representative in the PRC, or otherwise meet the conditions set by the regulator. Correct answer.

Explanation

Article 53 requires overseas processors subject to PIPL's extraterritorial reach to establish a dedicated body or appoint a representative within the PRC to handle personal information protection matters, and to file the representative's details with the relevant authority.

Question 22Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Which of the following activities falls outside the definition of personal information processing under PIPL?

  1. Sharing employee records with a payroll vendor.
  2. Collecting names and phone numbers for a customer database.
  3. Using anonymized statistical data that cannot be linked back to any individual. Correct answer.
  4. Deleting customer records after the retention period ends.

Explanation

Because PIPL excludes anonymized information from the definition of personal information, processing that involves only irreversibly anonymized data is outside the law's personal-information regime. The other options involve identifiable individuals and are covered.

Question 23Scope, definitions and basic concepts of the PRC Personal Information Protection Law

PIPL's definition of personal information includes 'identifiable' natural persons. What does this mean for pseudonymized data?

  1. Pseudonymized data is always sensitive personal information.
  2. Pseudonymized data can still be personal information if re-identification is possible using additional information. Correct answer.
  3. Pseudonymized data is treated as anonymized by default.
  4. Pseudonymized data is always outside PIPL because identifiers are removed.

Explanation

The identifiability standard means information remains personal information where it can be linked to an individual, directly or indirectly, including by combining it with other data. Pseudonymization reduces but does not necessarily eliminate identifiability.

Question 24Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Under PIPL, which body is primarily responsible for coordinating personal information protection work nationwide?

  1. The Cyberspace Administration of China, together with relevant departments under the State Council. Correct answer.
  2. The United Nations data protection office.
  3. A private industry association elected by processors.
  4. Individual data subjects acting collectively.

Explanation

Article 60 assigns the Cyberspace Administration of China, together with relevant departments of the State Council, responsibility for coordinating and supervising personal information protection nationwide. Local counterparts handle regional supervision.

Question 25Scope, definitions and basic concepts of the PRC Personal Information Protection Law

PIPL prohibits processors from refusing to provide products or services to individuals who do not consent to processing, unless consent is necessary for the product or service. What is the rationale for this rule?

  1. To eliminate the need for legal bases.
  2. To prevent coercion that would undermine the voluntariness of consent. Correct answer.
  3. To require consent for all processing regardless of necessity.
  4. To allow processors to charge higher prices for privacy.

Explanation

Article 16 prohibits refusing to provide products or services to individuals who do not consent, or who withdraw consent, unless processing is necessary for the product or service. The rule protects the voluntariness of consent by preventing bundling and coercion.

Question 26Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Under the PRC Personal Information Protection Law (PIPL), how is 'personal information' defined?

  1. Any recorded fact about an individual, including information that can no longer identify anyone
  2. Information about a natural person that is held by a government agency
  3. Information relating to an identified or identifiable natural person, recorded electronically or otherwise, excluding anonymized information Correct answer.
  4. Any data stored in an electronic information system that relates to a company's customers

Explanation

PIPL defines personal information as information relating to an identified or identifiable natural person, recorded electronically or by other means, but expressly excludes anonymized information. The definition is tied to identifiability of a natural person, not to the type of holder or storage medium.

Question 27Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Which legislative body adopted the PRC Personal Information Protection Law?

  1. The Supreme People's Court
  2. The State Council
  3. The Cyberspace Administration of China
  4. The Standing Committee of the National People's Congress Correct answer.

Explanation

PIPL is a national law adopted by the Standing Committee of the National People's Congress and took effect on 1 November 2021. The other bodies issue regulations, administrative measures, or judicial interpretations rather than adopting this statute.

Question 28Scope, definitions and basic concepts of the PRC Personal Information Protection Law

PIPL states that it is enacted in accordance with which constitutional principle?

  1. Protecting the personal dignity and personal information rights and interests of citizens Correct answer.
  2. Promoting the commercial use of personal data
  3. Guaranteeing the free flow of data across borders
  4. Safeguarding state-owned data assets

Explanation

The opening provisions of PIPL link the law to the protection of citizens' personal dignity and their personal information rights and interests. It is framed as a rights-protection statute, not a data-trade or asset-management statute.

Question 29Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Which of the following is expressly listed by PIPL as a category of sensitive personal information?

  1. Biometric characteristics Correct answer.
  2. Office email address
  3. Product serial number
  4. Company registration number

Explanation

PIPL lists biometric characteristics, religious belief, specific identity, medical health, financial accounts, and location tracking as sensitive personal information, along with information of minors under 14. Business contact details and product or company identifiers are not sensitive categories.

Question 30Scope, definitions and basic concepts of the PRC Personal Information Protection Law

What does PIPL mean when it states that personal information must be 'identifiable'?

  1. The information must be stored in a form that displays the person's full name
  2. The information, alone or combined with other information, can be used to identify a specific natural person Correct answer.
  3. The information must be encrypted so that no one can read it
  4. The information must be registered with a regulator before it can be processed

Explanation

Identifiability is assessed by whether information can be linked, alone or together with other data, to a specific natural person. It does not require that the name be displayed or that the data be registered or encrypted.

Question 31Scope, definitions and basic concepts of the PRC Personal Information Protection Law

PIPL states that the law applies to processing of personal information of natural persons within the territory of the PRC. What does this territorial rule mean for a wholly domestic processing operation?

  1. It falls outside PIPL because no cross-border element is present
  2. It falls within scope only if the data is sensitive personal information
  3. It falls within PIPL's scope because the processing occurs inside the PRC Correct answer.
  4. It falls within scope only if the individuals are PRC citizens

Explanation

PIPL's territorial scope is triggered by processing activities carried out within the PRC, regardless of the nationality of the individuals or the sensitivity of the data. Domestic processing therefore falls squarely within the law.

Question 32Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Which term does PIPL use for a natural or legal person that decides the purpose and means of processing personal information?

  1. Personal information processor Correct answer.
  2. Data controller
  3. Personal information handler
  4. Data custodian

Explanation

PIPL uses the term 'personal information processor' (个人信息处理者) for the entity that independently determines the purpose and means of processing. 'Data controller' is terminology from other legal regimes, not the PIPL term.

Question 33Scope, definitions and basic concepts of the PRC Personal Information Protection Law

PIPL requires that personal information processing have a clear and reasonable purpose and be directly related to that purpose. Which principle does this express?

  1. Processor licensing
  2. Anonymization
  3. Purpose limitation Correct answer.
  4. Data localization

Explanation

The principle of purpose limitation requires a clear, reasonable purpose and confines processing to what is directly related to it. Data localization concerns storage location, licensing concerns market entry, and anonymization concerns de-identification.

Question 34Scope, definitions and basic concepts of the PRC Personal Information Protection Law

An online retailer wants to analyze customer purchase histories to improve its own recommendation engine. Under PIPL, which role does the retailer occupy for that processing?

  1. Regulator, because it oversees its own data use
  2. Personal information processor, because it determines the purpose and means of the analysis Correct answer.
  3. Third-party recipient, because it uses data internally
  4. Entrusted party, because customers provided the data

Explanation

A party that decides why and how personal information is processed is the personal information processor. Internal use does not make the retailer an entrusted party or a third-party recipient.

Question 35Scope, definitions and basic concepts of the PRC Personal Information Protection Law

A hospital engages a cloud vendor to store patient records strictly according to the hospital's written instructions, with no independent decision-making by the vendor. How does PIPL characterize the vendor?

  1. A personal information processor with independent duties
  2. An entrusted party acting on the hospital's behalf Correct answer.
  3. A joint processor sharing purposes with the hospital
  4. A regulator of the hospital's data processing

Explanation

Where an entity processes personal information only on the instructions of another and does not determine purpose or means, PIPL treats it as an entrusted party. The hospital remains the personal information processor responsible for the arrangement.

Question 36Scope, definitions and basic concepts of the PRC Personal Information Protection Law

A marketing team wants to use a list of email addresses that has been stripped of names and replaced with random codes, but the codes are stored alongside a mapping table held by the same team. How should this data be treated under PIPL?

  1. As personal information, because it can still be linked to individuals through the mapping Correct answer.
  2. As anonymized information, because names have been removed
  3. As non-personal information, because the codes are random
  4. As sensitive personal information, because email addresses are involved

Explanation

Removing names does not anonymize data if a mapping table allows re-identification; such pseudonymized data remains personal information. Anonymization requires that the individual can no longer be identified and the data cannot be restored.

Question 37Scope, definitions and basic concepts of the PRC Personal Information Protection Law

A company processes fully anonymized statistical data that cannot be linked back to any individual and cannot be restored. What is the effect under PIPL?

  1. PIPL applies fully because the data originated from personal information
  2. PIPL applies only if the data is transferred abroad
  3. PIPL applies but with reduced consent requirements
  4. PIPL does not apply, because anonymized information is excluded from the definition of personal information Correct answer.

Explanation

PIPL excludes anonymized information from the definition of personal information, so processing that is genuinely anonymized falls outside the law's obligations. The exclusion depends on irreversibility, not on the data's origin.

Question 38Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Which of the following activities is a form of 'processing' as defined in PIPL?

  1. Only the initial collection of personal information
  2. Only the commercial sale of personal information
  3. Only the storage of personal information on paper
  4. Collecting, storing, using, transmitting, and deleting personal information Correct answer.

Explanation

PIPL defines processing broadly to include collection, storage, use, processing, transmission, provision, disclosure, deletion, and other operations. It is not limited to collection, sale, or a single storage medium.

Question 39Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Under PIPL, which body is responsible for coordinating personal information protection work nationwide and for supervising and managing personal information protection?

  1. The Ministry of Commerce
  2. The National Development and Reform Commission
  3. The Cyberspace Administration of China Correct answer.
  4. The People's Bank of China

Explanation

The Cyberspace Administration of China is designated to coordinate and supervise personal information protection work nationwide. Other departments handle personal information protection within their respective scopes.

Question 40Scope, definitions and basic concepts of the PRC Personal Information Protection Law

PIPL prohibits a processor from refusing to provide products or services to an individual who declines to consent to processing, unless that processing is necessary to provide the product or service. What does this rule target?

  1. Refusal to sell goods to customers who have not paid
  2. Forced or excessive consent demands that bundle unnecessary processing into service access Correct answer.
  3. Processing of sensitive personal information without a separate consent
  4. Failure to obtain any consent at all

Explanation

The rule prevents processors from coercing consent by tying access to unnecessary processing of personal information. It does not address payment, absence of consent generally, or the separate-consent rule for sensitive data.

Question 41Scope, definitions and basic concepts of the PRC Personal Information Protection Law

A processor wants to use personal information for a new purpose that was not covered by the original consent. What does PIPL require before that new processing can begin?

  1. Notify the regulator and proceed after 30 days
  2. Obtain fresh consent covering the new purpose Correct answer.
  3. Anonymize the data and then proceed without consent
  4. Rely on the original consent because the individual did not object

Explanation

Where a new purpose goes beyond the original consent, PIPL requires the processor to obtain consent again for that purpose. The original consent does not extend to purposes the individual did not agree to.

Question 42Scope, definitions and basic concepts of the PRC Personal Information Protection Law

PIPL requires a personal information protection impact assessment in certain circumstances. Which of the following triggers such an assessment?

  1. Entrusting processing of personal information or providing personal information to another processor Correct answer.
  2. Hiring a new employee in the human resources department
  3. Purchasing new laptops for staff
  4. Renewing an office lease

Explanation

PIPL requires an impact assessment before entrusting processing, providing personal information to other processors, disclosing it, processing sensitive information, or transferring it abroad. Ordinary business decisions unrelated to personal information processing do not trigger it.

Question 43Scope, definitions and basic concepts of the PRC Personal Information Protection Law

Which statement best describes the relationship between PIPL and the personality rights provisions of the PRC Civil Code?

  1. PIPL and the Civil Code are identical in every respect
  2. PIPL applies only to companies, while the Civil Code applies only to individuals
  3. PIPL is a special law that supplements the Civil Code's protection of personal information and prevails where its rules are more specific Correct answer.
  4. PIPL repeals the Civil Code's personality rights provisions entirely

Explanation

PIPL operates alongside the Civil Code as special legislation on personal information protection, adding detailed processing rules while the Civil Code provides the underlying personality rights framework. The two are complementary rather than mutually exclusive.

Question 44Scope, definitions and basic concepts of the PRC Personal Information Protection Law

A foreign company with no establishment in the PRC processes personal information of individuals located in the PRC to analyze their behavior. Under PIPL, which condition brings this processing within the law's extraterritorial scope?

  1. The processing is for the purpose of analyzing or assessing the behavior of individuals in the PRC Correct answer.
  2. The individuals are not PRC citizens
  3. The company uses servers located outside the PRC
  4. The company has no PRC customers

Explanation

PIPL applies extraterritorially where an overseas entity processes personal information of individuals in the PRC to provide products or services to them or to analyze or assess their behavior. Server location, nationality, and customer base are not the operative test.

Question 45Scope, definitions and basic concepts of the PRC Personal Information Protection Law

PIPL requires that personal information be collected for a clear and reasonable purpose and limited to the minimum scope necessary. Which term best captures this requirement?

  1. Data monetization
  2. Data localization
  3. Data minimization Correct answer.
  4. Data retention maximization

Explanation

Data minimization requires collecting only the personal information necessary for the stated purpose. Localization concerns storage location, monetization concerns commercial use, and retention maximization is the opposite of PIPL's storage limitation rule.

Question 46Scope, definitions and basic concepts of the PRC Personal Information Protection Law

An app collects a user's real-time location continuously to provide a maps feature, but also uses that location data to build advertising profiles without telling the user. Which PIPL principle is most directly engaged by the undisclosed advertising use?

  1. Processor licensing, because advertising requires a permit
  2. Data localization, because location data must stay in the PRC
  3. Anonymization, because location data is always anonymous
  4. Purpose limitation, because the use exceeds the stated purpose for which the data was collected Correct answer.

Explanation

Using location data for advertising profiles goes beyond the disclosed purpose of providing maps, engaging the purpose limitation principle. Localization, licensing, and anonymization are unrelated to the mismatch between stated and actual use.

Question 47Scope, definitions and basic concepts of the PRC Personal Information Protection Law

A company plans to process employees' fingerprint data for timekeeping. Which classification applies under PIPL?

  1. Sensitive personal information, because biometric characteristics are listed as sensitive Correct answer.
  2. Ordinary personal information, because it is used only internally
  3. Non-personal information, because it relates to employment
  4. Anonymized information, because fingerprints are unique

Explanation

Biometric characteristics are expressly listed as sensitive personal information under PIPL, which brings additional requirements such as separate consent and necessity justification. Internal use and uniqueness do not remove the data from the sensitive category.

Question 48Scope, definitions and basic concepts of the PRC Personal Information Protection Law

A processor holds a dataset that has been pseudonymized with a key held by a separate security team, and the processor argues the data is outside PIPL. How should this argument be assessed?

  1. It fails, because pseudonymized data that can be re-identified with additional information remains personal information Correct answer.
  2. It succeeds, because pseudonymization is the same as anonymization
  3. It succeeds, because the key is held by a different team
  4. It fails only if the data includes names

Explanation

PIPL treats information as personal information where it can identify a person alone or in combination with other information; pseudonymized data with a re-identification key therefore remains in scope. Anonymization requires that re-identification be impossible, which is not the case here.

Question 49Scope, definitions and basic concepts of the PRC Personal Information Protection Law

A PRC-based processor wants to transfer personal information to an overseas affiliate. Which statement correctly describes the trigger for PIPL's cross-border transfer requirements?

  1. Cross-border transfer rules apply only to sensitive personal information
  2. Cross-border transfer rules apply only to government agencies
  3. Transferring personal information abroad triggers additional requirements such as a security assessment, certification, or standard contract, depending on the circumstances Correct answer.
  4. Cross-border transfer is permitted freely as long as the data was collected with consent

Explanation

PIPL imposes specific conditions on providing personal information to recipients outside the PRC, including a security assessment, certification, or standard contractual clauses depending on the situation. Consent alone does not satisfy the cross-border regime, and the rules are not limited to sensitive data or public bodies.

Question 50Scope, definitions and basic concepts of the PRC Personal Information Protection Law

A processor argues that because it obtained general consent at sign-up, it may also process sensitive personal information for a loyalty program without further steps. How should this be evaluated under PIPL?

  1. It is insufficient only if the individual is a minor
  2. It is insufficient, because processing sensitive personal information requires separate consent and a demonstration of specific necessity and strict protection Correct answer.
  3. It is sufficient, because general consent covers all later processing
  4. It is sufficient, because loyalty programs are a core service

Explanation

PIPL requires separate consent for processing sensitive personal information, along with specific purpose and strict protection measures. General sign-up consent does not extend to sensitive categories, and the rule is not limited to minors.