EXIN PDPF common mistakes
EXIN PDPF · Understand the traps and how to avoid them.
Treating the PIPL's three legal bases for processing as interchangeable with the GDPR's six, and answering that consent is required for any processing of personal information unless an exception applies.
Candidates study the GDPR first or by analogy and carry over the assumption that consent is the default basis. The PIPL instead lists consent plus several independent bases (contract necessity, statutory duty, public interest, emergency, publicly disclosed information within reasonable scope, other laws), so consent is only one route.
What to do instead
Memorise the PIPL Article 13 list as a set of parallel bases and practise classifying short scenarios by asking 'which single basis fits best?' rather than 'is there consent?'. Note where the PIPL requires separate consent (sensitive information, provision to third parties, public disclosure, cross-border transfer, use for automated decision-making) as an overlay on top of the base.
Confusing the roles of the personal information processor (处理者) and the entrusted party (受托方), and assigning controller-style obligations such as obtaining consent or responding to data subject requests to the entrusted party.
The Chinese terms 处理者 and 受托方 look similar to a non-native reader, and the GDPR's controller/processor split maps only loosely. Candidates then misattribute duties in questions about entrustment agreements and joint liability.
What to do instead
Anchor the distinction: the processor determines purpose and method and bears the primary obligations; the entrusted party acts only on instructions, must not process beyond the agreement, and must return or delete information when the entrustment ends. Learn the Article 21 requirement that the processor supervise the entrusted party, and that the processor bears joint liability with the entrusted party toward individuals where the entrusted party causes harm.
Applying the general breach-notification rule without the immediate-notice step, i.e. stating only that the authority must be told within a fixed period and omitting the duty to notify affected individuals.
Candidates compress the Article 57 obligation into a single deadline and forget the two-track structure: immediate notification to the authority and, where harm to rights and interests is likely, notification to individuals, with the authority notified of the individual-notification decision if that step is not taken.
What to do instead
Build a three-part checklist for any breach scenario: (1) immediate remedial action and notification to the authority, (2) notification to individuals when harm is possible, including what was leaked, possible consequences, and remedies, (3) record the reasoning when individuals are not notified. Practise drafting the notification content elements so they are recalled together.
Answering cross-border transfer questions by citing only one transfer mechanism, typically a security assessment, without recognising the alternatives of certification by a professional body or standard contractual clauses filed with the authority.
The three routes are introduced in different instruments and amended over time, and candidates memorise whichever one appeared in the first source they read. They also miss the threshold logic that determines which route is available.
What to do instead
Learn the three mechanisms as a menu and the trigger conditions for each, then practise matching a scenario to the correct route. Also recall the separate requirement to obtain separate consent for cross-border provision and to inform individuals of the overseas recipient's name, contact details, purpose, method, categories, and how to exercise rights with that recipient.
Treating sensitive personal information as merely a higher-risk category requiring more care, instead of recalling the specific triggers that make it sensitive and the specific extra obligations attached.
Candidates rely on intuition about which data 'feels' sensitive rather than the statutory enumeration, and they under-count the added duties such as separate consent, specific purpose and sufficient necessity, strict protection measures, and the personal information protection impact assessment.
What to do instead
Memorise the enumerated categories (biometrics, religious belief, specific identity, medical health, financial accounts, whereabouts, and minors under 14) and the rule that information about a minor under 14 counts as sensitive and requires the guardian's consent. For each sensitive-data scenario, run the same four checks: separate consent, necessity and specific purpose, enhanced safeguards, and impact assessment.
Describing the individual's rights as a single right to 'access and delete', and so failing questions that hinge on the distinction between the right to know and decide, to consult and copy, to correct and supplement, and to delete.
The rights in Articles 44 to 47 are stated compactly and are easy to blur into one another, especially because the right to restrict or refuse processing is embedded in the right to decide rather than listed separately.
What to do instead
Make a four-row table of the rights with the exact trigger conditions for deletion (purpose achieved or no longer necessary, processing stopped, consent withdrawn, unlawful processing, other statutory cases) and for consultation/copy. Test yourself by matching a one-line scenario to the precise right rather than a general 'data subject right'.
Assuming the PIPL applies only to organisations established in China, and therefore excluding a foreign company that provides products or services to people in China from the scope question.
Candidates conflate territorial establishment with extraterritorial reach, missing the Article 2 extension to processing outside China for the purpose of providing products or services to, or analysing or assessing the behaviour of, individuals in China.
What to do instead
Learn the two-limb scope test: processing within China, plus extraterritorial processing aimed at people in China. Then learn the consequence of extraterritorial application, namely the requirement to establish a dedicated entity or representative in China and to record the representative's details with the authority, and practise scope questions by testing each limb separately.
Treating the personal information protection impact assessment as a one-off document produced at project launch, and missing the situations that trigger a fresh assessment.
Candidates treat compliance artefacts as static deliverables, so they do not connect the assessment to triggering events such as processing sensitive information, automated decision-making, entrusting processing, providing information to third parties, public disclosure, and cross-border transfer.
What to do instead
Memorise the trigger list and the required content of the assessment report, including whether the processing is lawful and necessary, the impact on individuals' rights, and whether protective measures are commensurate with risk. Note that the report and records must be retained for at least three years, and practise spotting triggers in a scenario that starts as routine processing.
Answering questions about the protection of deceased persons' personal information by saying the PIPL does not apply at all, rather than recognising that close relatives may exercise certain rights for their own lawful and legitimate interests.
Candidates reason that legal personality ends at death and therefore the statute ends too, overlooking the specific provision that keeps a limited set of rights exercisable by relatives.
What to do instead
Learn the deceased-person rule as a discrete exception: relatives may consult, copy, correct, and delete the deceased's information for their own lawful and legitimate interests, unless the deceased arranged otherwise before death. Pair it with the related point that the law also protects personal information contained in anonymised-looking data where re-identification is possible.
Describing the regulator's enforcement as a single fine and ignoring the graduated toolkit, including orders to correct, warnings, confiscation of illegal gains, suspension or termination of service, and suspension of the responsible individuals' duties.
Candidates memorise only the headline maximum penalty and cannot answer questions about which sanction fits which violation, or about personal liability of directly responsible persons.
What to do instead
Build a ladder from mild to severe: order to correct, warning, confiscation of illegal gains, fine, suspension or termination of service, and suspension of business or revocation of licences for serious cases, plus fines on directly responsible individuals and a ban on holding relevant positions. Attach the aggravating circumstances (serious consequences, repeated violations) to the top of the ladder and practise choosing the proportionate sanction.