Scope, definitions and basic concepts of the PRC Personal Information Protection Law
Scope, definitions and basic concepts
This domain tests whether a processing activity falls inside the PRC Personal Information Protection Law (PIPL) and how the data is classified. Questions usually turn on territorial reach, the personal/family exemption, and de-identification versus anonymization.
Scope
PIPL applies under Article 3 to processing of personal information of natural persons in the PRC. It also applies outside the PRC where an overseas processor provides products or services to persons in the PRC, or analyzes or evaluates their behavior. That overseas processor must appoint a dedicated entity or representative in the PRC and file with the regulator. Processing by a natural person for personal or family affairs is excluded, but this is narrow and does not cover commercial activity.
Key definitions
- Personal information: information related to an identified or identifiable natural person, recorded electronically or otherwise, excluding anonymized information.
- Sensitive personal information: biometric characteristics, religious beliefs, specific identity, medical health, financial accounts, whereabouts, and personal information of minors under 14.
- Processing: collection, storage, use, processing, transmission, provision, disclosure, deletion and similar operations.
- De-identification: a specific person cannot be identified without additional information; the data remains personal information. Anonymization: identity cannot be restored; PIPL does not apply.
- Processor: the organization or individual that independently decides purpose and means.
Principles
Lawfulness, propriety, necessity and good faith; minimum scope; transparency; accuracy; accountability and security.
Worked example
A fitness app based abroad sells workout plans to users in Shanghai and tracks real-time location. It targets PRC users and analyzes their behavior, so PIPL applies extraterritorially. Location is sensitive personal information, requiring a specific purpose, strict necessity and separate consent. If the app replaces names with codes but keeps a re-identification key, the data is de-identified, not anonymized, and remains in scope.
Traps
Pseudonymized data is still personal information. The personal/family exemption does not cover a side business. Sensitive data includes minors under 14, not only health data. Overseas processing is not automatically outside PIPL.