Obligations of personal information processors
Obligations of personal information processors
This domain tests the compliance infrastructure a processor must maintain before, during and after processing. Questions focus on the impact assessment, the protection officer, entrusted processing, breach notification and platform duties.
Core obligations
Processors must:
- adopt internal management rules and classified management;
- use encryption and de-identification;
- train staff and set operational permissions;
- prepare contingency plans and conduct audits;
- appoint a personal information protection officer where the volume reaches the regulator's threshold, and publish contact details;
- conduct a personal information protection impact assessment before processing sensitive data, using automated decision-making, entrusting, sharing, public disclosure, or cross-border transfer; reports must be kept at least three years;
- conclude an entrustment agreement and supervise the entrusted party; without consent, the entrusted party cannot subcontract;
- notify the regulator and affected individuals of a breach that may cause harm, stating the cause, harm, remedies and contact person;
- meet cross-border transfer conditions: security assessment, certification, standard contract, or another lawful route.
Worked example
A retailer suffers a leak of 200,000 customer records including bank card data. Because financial account data is sensitive and harm is likely, the retailer must notify the regulator and affected individuals without delay. The notice must explain the leak, possible harm, steps taken and a contact point. The retailer must also preserve evidence and update its impact assessment. If it had transferred the data to a cloud vendor without an entrustment agreement, that is a separate violation.
Traps
An impact assessment is done before the processing, not after a complaint. The entrusted party is not free to repurpose data. Breach notification is not only to the regulator. A standard contract is not available for every transfer scenario. The protection officer is not a cosmetic role; contact details must be published.
Governance and accountability
Governance and accountability
This domain tests who supervises PIPL, how enforcement works, and how a processor builds accountable governance. Exam items often compare the general regulator with sector regulators, or ask about the fine ceiling and personal liability.
Regulatory architecture
The Cyberspace Administration of China (CAC) is responsible for overall coordination and supervision. Relevant departments under the State Council and local governments supervise within their respective duties. This produces dual oversight: a finance app may face the CAC and the financial regulator. The CAC also coordinates cross-border transfer and major incidents.
Enforcement tools
Regulators may order correction, issue warnings, confiscate illegal gains, and impose fines. For serious violations, fines can reach RMB 50 million or 5% of the previous year's turnover, and the business may be suspended or its licence revoked. Responsible individuals can be fined up to RMB 1 million. Credit records may be published. Civil and criminal liability can run in parallel.
Accountability in practice
A defensible programme has board-level ownership, a written data inventory, role-based access, vendor management, training records, a complaint channel, impact assessments, and a tested incident plan. The processor must publish its complaint contact and handle complaints promptly. Internal audits should be documented because regulators ask for evidence, not assurances.
Worked example
A platform suffers a breach and the regulator finds no impact assessment for sensitive-data processing and no published complaint contact. The regulator may order correction, warn the company, and fine it. If the failure is serious, the fine can be calculated against turnover and responsible managers can be personally fined. The company's remediation should include a data inventory, a completed assessment, published contacts and a breach-response test.
Traps
Do not assume only the CAC enforces PIPL. Do not treat the fine ceiling as the only exposure; suspension and personal liability matter. Do not confuse accountability documents with actual evidence of operation. A complaint channel that is unpublished or unstaffed is a governance failure.