The Singapore payroll vendor with a Shanghai support desk
Nestor HR Pte Ltd is incorporated in Singapore and runs a payroll SaaS platform on Singapore servers. It has a Shanghai office of 14 sales and support staff. Its client is Hengfa Precision, a Suzhou manufacturer with 3,800 employees. For each employee Nestor holds name, national ID number, bank account, monthly salary, fingerprint templates used at the factory gate, and annual health-check results covering blood pressure and liver function. The Shanghai support team occasionally downloads the full employee list to reconcile payroll errors on its own initiative. The master services agreement states that Nestor is 'a data processor acting on Hengfa's written instructions'. Hengfa's legal team asks three things: whether Chinese law reaches Nestor at all, how the roles should be described, and what the fingerprint and health data change about the arrangement.
1. Does the Personal Information Protection Law apply to Nestor, and on what grounds?
Read the worked answer
Yes, on two independent grounds - and the second is the one candidates usually miss.
- Article 3(1), processing inside the territory. Nestor's Shanghai office is an establishment in China. Support, ticketing and reconciliation carried out there is in-territory processing, caught directly.
- Article 3(2), extraterritorial reach. The Singapore-side processing is also caught, because Nestor processes personal information of natural persons in China in order to provide products or services to them (payroll is a service delivered to Hengfa's employees) and, in the analytics sense, to analyse and evaluate behaviour. Article 3(2) does not ask where the company is incorporated; it asks about the purpose of the processing and where the individuals are.
- What follows from the extraterritorial limb: Article 53 requires a handler outside China to designate a domestic institution or a representative in China and report that name and contact to the department performing personal information protection duties. The Shanghai entity is the obvious candidate, but the designation must be documented and reported - having an office is not the same as complying.
On the label: 'data processor' is contractual shorthand, not a legal shield. Under Article 73(1) the test is whether the entity independently determines the purpose and method of processing. Conduct decides, not wording.
2. How should Hengfa and Nestor be classified under the law, and what does that classification oblige Nestor to do?
Read the worked answer
Classification: Hengfa independently determines why and how the employee data is processed, so it is the personal information handler (Article 73(1)). Nestor is the entrusted party under Article 21 - it processes on Hengfa's behalf and within its instructions.
What Article 21 requires of Nestor:
- Process only in accordance with the agreed purpose, method and scope, and not exceed the instructions.
- Not re-entrust the processing to a subcontractor without Hengfa's consent, and if it does, supervise the subcontractor.
- Assist Hengfa in responding to individuals' rights requests and in meeting Article 51 security duties.
- Return the data, or delete it, when the engagement ends - and be able to prove deletion.
The trap in this scenario: when the Shanghai team downloads the full employee list to reconcile errors 'on its own initiative', it is no longer acting on instructions. For that operation Nestor determines the purpose itself, becomes a handler in its own right, and needs its own legal basis, its own Article 17 notice and its own retention limit. A contract cannot pre-authorise conduct the handler never directed.
Correct fix: convert that work into a documented instruction from Hengfa (or eliminate the full-list download), and keep an instruction log that the regulator could audit.
3. Which data elements are sensitive personal information, and what extra requirements apply to them?
Read the worked answer
Fingerprint templates are biometric data and therefore sensitive personal information under Article 28. Health-check results (blood pressure, liver function) are medical health data, also sensitive. Name, ID number, bank account and salary are ordinary personal information, although the ID number and bank account raise the identity-theft risk profile and should be encrypted and segregated.
Additional requirements once data is sensitive (Articles 28–32):
- Specific purpose and sufficient necessity, with strict measures - a general 'payroll administration' rationale does not justify continuous biometric template storage. The necessity test is met by a factory access card just as well as by a fingerprint; the less intrusive means should be preferred.
- Separate consent (Article 29). It must be a distinct, granular act - not buried in an employment contract or in a single onboarding checkbox.
- Extra notice (Article 30): the handler must also inform the individual of the necessity of the processing and the impact on the individual's rights and interests.
- Personal information protection impact assessment before processing starts (Article 55(1)), with the report and processing record kept for at least three years (Article 56).
Practical consequence here: Hengfa must obtain the separate consent, run the impact assessment, and probably replace fingerprint attendance with a non-biometric method. Nestor, as the entrusted party, must implement the stricter access, encryption and logging controls this data class demands.