EXIN PDPF cheat sheet

Personal information (PI) is any information, recorded electronically or otherwise, related to an identified or identifiable natural person; anonymized information is excluded from the PIPL's scope.

The PIPL (effective 1 November 2021) has 74 articles across 8 chapters: general provisions, processing rules, cross-border rules, individual rights, processor obligations, state department duties, legal liability, supplementary provisions.

Processing means any operation on PI: collection, storage, use, processing, transmission, provision, disclosure, deletion, and other activities.

Extraterritorial reach applies when PI of persons in China is processed from abroad to provide products or services to them or to analyze/evaluate their behavior.

Sensitive PI is PI that, once leaked or illegally used, may easily lead to dignity harm or personal/property harm: biometrics, religious belief, specific identity, medical health, financial accounts, whereabouts, and PI of minors under 14.

The PIPL is a comprehensive law; sector rules (e.g., cybersecurity, data security, consumer protection) apply cumulatively where they add requirements.

The Cyberspace Administration of China (CAC) is the primary coordinating regulator; sector regulators handle PI in their own fields.

Key lawful bases are consent, contract necessity, statutory duty, public interest, public health/emergency, and other legal bases; consent is not the only basis.

The data subject is the individual to whom PI relates; the processor (personal information handler) determines the purpose and means of processing.

Valid consent must be voluntary, explicit, and informed; consent is invalid where the purpose, method, or scope is not fully disclosed or where processing exceeds the disclosed scope.

Separate consent is required for processing sensitive PI, providing PI to another processor, public disclosure of PI, and cross-border transfer of PI.

For PI of minors under 14, the guardian's consent is required and a dedicated processing rule must be established.

Automated decision-making must be transparent and fair; where a decision significantly affects an individual's rights, the individual may refuse and the processor must provide an explanation or alternative.

Processing must follow the principles of lawfulness, legitimacy, necessity, and good faith, and be limited to the minimum scope necessary to achieve the purpose.

Cross-border transfer requires one of: CAC security assessment, certification by a professional body, standard contractual clauses filed with the CAC, or other conditions set by law.

When providing PI to a third party, the processor must inform the individual of the recipient's name/contact, purpose, and method, and obtain separate consent.

Where a merger, division, or bankruptcy transfers PI, the processor must inform the individual of the recipient and obtain consent; the recipient must continue to honor processor obligations.

A personal information protection impact assessment (PIPIA) is required for sensitive PI, automated decision-making, entrusting processing, providing PI to others, and public disclosure, and records must be kept at least 3 years.

Processors must implement technical and administrative safeguards appropriate to the PI handled, including encryption, de-identification, and access controls.

A designated person (often a DPO or PIP officer) is required for processors above a threshold volume set by the CAC; the role oversees processing compliance.

A data breach must be reported to the regulator and to affected individuals without delay; notification must describe the breach, likely consequences, and remediation.

Individuals have rights to know, decide, restrict or refuse processing, access, copy, correct, and delete their PI, and to request transfer to another processor.

A request to delete PI must be honored where the purpose is achieved, the service is stopped, consent is withdrawn, or processing was unlawful; retention beyond necessity is prohibited.

Processors must respond to individual rights requests within a reasonable period; refusal must state reasons, and the individual may sue or complain to the regulator.

Regulatory penalties can include warnings, confiscation of illegal gains, fines up to RMB 50 million or 5% of prior-year turnover for serious violations, suspension of business, and revocation of licenses.

A PIPIA must assess the legality of processing, the impact on individuals' rights, and the effectiveness of protective measures, and the report must be retained.

Processors must regularly audit their processing activities and train staff; records of processing activities and consent evidence should be maintained.