EXIN PDPF flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Definition of personal information

Any information, recorded electronically or otherwise, related to an identified or identifiable natural person, excluding anonymized information that cannot be used to identify a specific person.

PIPL effective date

The Personal Information Protection Law of the People's Republic of China took effect on 1 November 2021 and contains 74 articles across eight chapters.

Meaning of processing

Any operation performed on personal information, including collection, storage, use, processing, transmission, provision, disclosure, deletion, and similar activities.

Extraterritorial application

The PIPL applies to processing outside China where the purpose is to provide products or services to persons in China or to analyze or evaluate their behavior.

Sensitive personal information

PI that, if leaked or misused, may easily harm personal dignity or property: biometrics, religion, specific identity, medical health, financial accounts, whereabouts, and data of minors under 14.

Data subject

The natural person to whom personal information relates and whose rights the PIPL protects, including rights to know, decide, access, correct, and delete.

Processor (handler)

The organization or individual that independently determines the purpose and means of processing personal information and bears the corresponding legal obligations.

Primary regulator

The Cyberspace Administration of China coordinates personal information protection nationally, while sector regulators supervise processing within their own fields.

Anonymization vs de-identification

Anonymized information falls outside the PIPL, whereas de-identified information remains personal information and must be protected, with re-identification prohibited without consent.

Lawful bases for processing

Processing is permitted where consent is given, necessary for a contract, required by law, or justified by public interest, public health emergency, or other statutory grounds.

Valid consent requirements

Consent must be voluntary, explicit, and informed; it is invalid if the purpose, method, and scope are not fully disclosed or processing exceeds that scope.

Separate consent triggers

Separate consent is required for sensitive PI, providing PI to another processor, public disclosure, and cross-border transfer of personal information.

Minors under 14

Processing PI of children under 14 requires the guardian's consent and a dedicated processing rule specifying storage, use, and protection measures.

Purpose limitation

Personal information may be processed only for the purpose disclosed to the individual; processing beyond that purpose requires a new lawful basis, usually fresh consent.

Minimum necessity principle

Processing must be limited to the minimum scope and frequency needed to achieve the stated purpose, and collection of irrelevant data is prohibited.

Automated decision-making rules

Automated decisions must be transparent and fair; where a decision significantly affects an individual, the person may refuse and request an explanation or alternative.

Third-party provision notice

Before providing PI to a third party, the processor must inform the individual of the recipient's identity, contact, purpose, and method, and obtain separate consent.

Cross-border transfer mechanisms

Transfer abroad requires a CAC security assessment, professional certification, filed standard contractual clauses, or another condition set by law or CAC rules.

Merger or bankruptcy transfer

Where PI is transferred due to merger, division, or bankruptcy, the individual must be informed of the recipient and consent obtained; the recipient honors processor duties.

PIPIA triggers

A personal information protection impact assessment is required for sensitive PI, automated decision-making, entrusting processing, providing PI to others, and public disclosure.

Entrusted processing

When entrusting processing, the processor agrees the purpose, period, and method with the entrusted party and supervises performance; the entrusted party cannot process beyond instructions.

Security safeguards

Processors must adopt technical and administrative measures such as encryption, de-identification, access control, and staff training appropriate to the data handled.

Breach notification

A personal information breach must be reported to the regulator and affected individuals without delay, describing the breach, likely consequences, and remediation taken.

Individual rights set

Individuals may know, decide, restrict or refuse processing, access, copy, correct, and delete their PI, and request transfer to a designated processor.

Deletion conditions

Deletion must occur when the purpose is achieved, service stops, consent is withdrawn, or processing was unlawful; retention beyond necessity is prohibited.

Responding to requests

Processors must respond to rights requests within a reasonable period; refusals must state reasons, and individuals may complain or sue.

Serious violation penalties

Serious violations may bring fines up to RMB 50 million or 5% of prior-year turnover, suspension of business, revocation of licenses, and personal liability for responsible officers.

Data protection officer

Processors meeting the volume threshold set by the CAC must designate a person responsible for personal information protection to oversee compliance.

Record retention

Processing records, consent evidence, and impact assessment reports must be kept; PIPIA reports must be retained for at least three years.

Complaint and lawsuit rights

Individuals may complain to the regulator or file a lawsuit where their personal information rights are infringed, including by unlawful processing.

Processor liability for entrusted party

The original processor remains liable for processing carried out by an entrusted party that acts beyond the agreed instructions or causes harm to individuals.

Access and copy rights

Individuals may request access to and a copy of their personal information; the processor must provide it unless an exception applies.