I85PREP
⌘ K
EXIN PDPF study materials
EXIN PDPF study resources

EXIN PDPF practice questions

One question at a time. Build your EXIN PDPF understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Basics of the Personal Information Protection Law

Under China's Personal Information Protection Law (PIPL), which statement best describes the relationship between the law and the processing of personal information by state organs?

  1. State organs may process personal information only with each individual's separate written consent.
  2. State organs are governed exclusively by the Cybersecurity Law and not by PIPL.
  3. State organs must handle personal information in accordance with PIPL when performing statutory duties. Correct answer.
  4. State organs are entirely exempt from PIPL because they act in the public interest.

Explanation

PIPL contains a dedicated chapter on state organs, confirming that they must handle personal information in accordance with the law when performing statutory duties within their authority. Their public-law status does not remove them from PIPL's scope, although the basis for processing differs from consent-based commercial processing.

Question 2Basics of the Personal Information Protection Law

Which of the following is listed by PIPL as a category of sensitive personal information?

  1. Biometric characteristics Correct answer.
  2. A person's office telephone extension
  3. Publicly available weather data
  4. The name of a company's registered address

Explanation

PIPL defines sensitive personal information as information that, once leaked or illegally used, may easily cause harm to personal dignity or endanger personal or property safety. Biometric characteristics, religious belief, specific identity, medical health, financial accounts, and whereabouts are expressly included, while ordinary business contact details are not.

Question 3Basics of the Personal Information Protection Law

PIPL requires that the purpose and manner of processing personal information be clear and reasonable and that the processing be directly related to the purpose. Which principle does this requirement express?

  1. The principle of mandatory data localization
  2. The principle of data minimization and purpose limitation Correct answer.
  3. The principle of extraterritorial application
  4. The principle of state ownership of data

Explanation

PIPL requires processing to have a clear, reasonable purpose and to be limited to the minimum scope and manner necessary for that purpose. This combines purpose limitation with data minimization, meaning controllers should not collect or use more than the stated purpose justifies.

Question 4Basics of the Personal Information Protection Law

A marketing company wants to process an individual's personal information based on consent. Under PIPL, what must that consent generally be?

  1. Given voluntarily and explicitly on a fully informed basis Correct answer.
  2. Obtained orally and recorded only in an internal memo
  3. Implied by the individual's continued use of the company's website
  4. Presumed where the individual has not objected within 30 days

Explanation

PIPL requires consent to be given voluntarily and explicitly by the individual on a fully informed basis, with the right to withdraw. Silence, pre-ticked boxes, or continued browsing do not satisfy this standard for consent-based processing.

Question 5Basics of the Personal Information Protection Law

For which situation does PIPL require a separate consent from the individual rather than ordinary consent?

  1. Responding to a request from the individual to access their own data
  2. Processing an employee's information to pay statutory social insurance
  3. Publishing a company's annual financial statements
  4. Providing personal information to another personal information processor Correct answer.

Explanation

PIPL lists specific situations requiring separate consent, including providing personal information to another processor, processing sensitive personal information, processing information in a public place for image collection or identity verification, and cross-border transfer. Separate consent means a distinct, specific authorization rather than one bundled general consent.

Question 6Basics of the Personal Information Protection Law

Under PIPL, when a personal information processor entrusts another party to process personal information on its behalf, which obligation applies?

  1. The entrusting party must agree with the entrusted party on the processing purpose, period, and manner, and supervise the entrusted processing. Correct answer.
  2. The entrusted party becomes an independent controller free of the entrusting party's instructions.
  3. The entrusting party is released from liability once the data is handed over.
  4. The entrusted party must obtain fresh consent from every individual for each processing step.

Explanation

PIPL requires entrusting parties to agree on the purpose, period, processing method, and protection measures, and to supervise the entrusted party's processing. The entrusted party may only process according to the agreement and must return or delete the data when the entrustment ends.

Question 7Basics of the Personal Information Protection Law

A retailer and a logistics provider jointly decide the purposes and means of processing customer delivery data. Under PIPL, how should they be characterized?

  1. As an entrusting party and an entrusted party with no shared responsibility
  2. As two independent controllers with no legal relationship
  3. As a controller and a state organ exercising public authority
  4. As joint personal information processors who must agree on respective rights and obligations Correct answer.

Explanation

When two or more parties jointly decide the purposes and means of processing, PIPL treats them as joint processors. They must agree on their respective rights and obligations, and individuals may exercise their rights against either party, which then must cooperate.

Question 8Basics of the Personal Information Protection Law

PIPL requires personal information processors to conduct a personal information protection impact assessment (PIPIA) in specified circumstances. Which situation triggers this requirement?

  1. Hiring a new receptionist
  2. Processing sensitive personal information Correct answer.
  3. Renewing an office lease
  4. Sending a routine order confirmation email to an existing customer

Explanation

PIPL requires an impact assessment before processing sensitive personal information, using personal information for automated decision-making, entrusting processing, providing information to other processors, or cross-border transfer. The assessment must be recorded and retained for at least three years.

Question 9Basics of the Personal Information Protection Law

An online platform uses personal information to make automated decisions that significantly affect individuals. What does PIPL require?

  1. The platform must delete all personal information after each decision.
  2. The platform must transfer the decision to a state organ for approval.
  3. The platform may refuse to explain any automated decision to protect trade secrets.
  4. The platform must disclose the decision logic and provide a way for individuals to refuse decisions made solely by automated means. Correct answer.

Explanation

PIPL requires that automated decision-making be transparent and fair, that the decision logic not be used for unreasonable differential treatment, and that individuals be offered a way to refuse decisions made solely by automated means or to demand an explanation.

Question 10Basics of the Personal Information Protection Law

Under PIPL, which right allows an individual to request that a processor correct or complete inaccurate personal information?

  1. The right to restrict processing
  2. The right to rectification and completion Correct answer.
  3. The right to erasure
  4. The right to data portability

Explanation

PIPL grants individuals the right to request correction or completion of inaccurate or incomplete personal information, and the processor must verify and correct it promptly. This is distinct from erasure, which concerns deletion when processing is unlawful or the purpose has been achieved.

Question 11Basics of the Personal Information Protection Law

An individual asks a controller to delete their personal information because the processing purpose has been achieved. How should the controller respond under PIPL?

  1. Transfer the information to a state organ instead of deleting it
  2. Refuse because retention is always permitted for business convenience
  3. Charge a fee before deleting the information
  4. Delete the information unless a law or regulation requires retention Correct answer.

Explanation

PIPL gives individuals the right to request deletion when the processing purpose has been achieved, the service has ceased, consent has been withdrawn, processing is unlawful, or other statutory conditions apply. The processor must delete promptly unless a law or regulation requires retention.

Question 12Basics of the Personal Information Protection Law

A Chinese company transfers personal information to a recipient outside China. Which mechanism is recognized by PIPL for such a cross-border transfer?

  1. Obtaining an oral confirmation from the foreign recipient
  2. Completing a security assessment organized by the competent authority Correct answer.
  3. Self-declared exemption from all transfer rules
  4. Publishing a notice on the company's website

Explanation

PIPL permits cross-border transfer through specified mechanisms, including a security assessment organized by the Cyberspace Administration, certification by a professional body, or standard contractual clauses filed with the authority. These mechanisms ensure the recipient's processing meets PIPL's protection standard.

Question 13Basics of the Personal Information Protection Law

Before transferring personal information abroad, PIPL requires the processor to take steps to protect individuals' rights. Which step is required?

  1. Publish the individual's data on a public register
  2. Inform the individual of the overseas recipient's name and contact details and obtain separate consent Correct answer.
  3. Obtain approval from every individual's employer
  4. Delete all data held domestically

Explanation

PIPL requires the processor to inform individuals of the overseas recipient's identity and contact information, the purpose and method of processing, and how to exercise rights, and to obtain separate consent. This ensures individuals understand where their data goes and can act on their rights.

Question 14Basics of the Personal Information Protection Law

Which statement correctly describes the obligations of a personal information processor regarding a data breach under PIPL?

  1. Wait for the individuals to discover the breach themselves
  2. Notify only the foreign recipient of the data
  3. Take immediate remedial measures and notify the authority and affected individuals as required Correct answer.
  4. Notify only the police and never the affected individuals

Explanation

PIPL requires processors to take immediate remedial measures upon learning of a leak, distortion, or loss, and to notify the competent authority and affected individuals. Notification must describe the categories of information, possible consequences, remedial measures, and contact details.

Question 15Basics of the Personal Information Protection Law

PIPL requires larger processors to designate a person responsible for personal information protection. What is the general trigger for this requirement?

  1. Selling products online
  2. Processing any personal information at all, even a single record
  3. Having more than one employee
  4. Processing personal information reaching the volume threshold set by the national cyberspace authority Correct answer.

Explanation

PIPL requires processors whose volume of processed personal information reaches the threshold set by the national cyberspace authority to designate a person in charge of personal information protection. That responsible person oversees processing activities and protection measures.

Question 16Basics of the Personal Information Protection Law

A company processes personal information for a purpose not covered by the original consent. What must it do under PIPL?

  1. Assume implied consent from continued use of the service
  2. Proceed because consent covers all future purposes
  3. Obtain fresh consent for the new purpose Correct answer.
  4. Rely on the individual's silence as approval

Explanation

PIPL requires that processing stay within the agreed purpose and manner; changing the purpose or method requires renewed consent. Consent is purpose-specific, so a general initial consent cannot authorize unrelated later uses.

Question 17Basics of the Personal Information Protection Law

Which best describes the individual's rights over their personal information under PIPL?

  1. Individuals must pay to exercise any right.
  2. Individuals have no rights once data is collected.
  3. Individuals may only request deletion but not access.
  4. Individuals have the right to know, decide, and restrict the processing of their personal information. Correct answer.

Explanation

PIPL grants individuals the right to know and decide on the processing of their personal information and to restrict or refuse processing, alongside access, correction, deletion, and portability rights. These rights may be exercised free of charge.

Question 18Basics of the Personal Information Protection Law

A processor wants to use personal information already collected for a new purpose that is closely related to the original purpose. What does PIPL allow?

  1. Use for the related purpose without new consent if the purpose is reasonably related and the individual's rights are not harmed Correct answer.
  2. Use only after receiving written approval from a state organ
  3. Use only if the data is first transferred abroad
  4. Use for any purpose without consent

Explanation

PIPL permits processing for a purpose reasonably related to the original purpose without fresh consent, provided the new use does not harm the individual's rights and interests. This recognizes that closely related uses are within the reasonable expectations created at collection.

Question 19Basics of the Personal Information Protection Law

Which entity is responsible for coordinating personal information protection work nationwide under PIPL?

  1. Each individual company's board of directors
  2. A foreign data protection authority
  3. The national cyberspace authority Correct answer.
  4. The World Trade Organization

Explanation

PIPL assigns the national cyberspace authority to coordinate and supervise personal information protection nationwide, with other departments handling protection within their respective duties. Local cyberspace authorities handle matters within their regions.

Question 20Basics of the Personal Information Protection Law

A company discovers that an employee leaked customer data. Which set of measures best reflects PIPL's breach response obligations?

  1. Delete all company records to hide the incident
  2. Wait until the next annual report to disclose the incident
  3. Notify only the employee's family
  4. Investigate, take remedial measures, assess harm, and notify the authority and affected individuals as required Correct answer.

Explanation

PIPL requires prompt remedial action, an assessment of possible harm, and notification to the authority and affected individuals where their rights may be harmed. The notice must explain the incident, its possible consequences, remedial measures, and how individuals can protect themselves.

Question 21Basics of the Personal Information Protection Law

Which statement about PIPL's application to processing activities outside China is correct?

  1. PIPL never applies to processing outside China.
  2. PIPL applies only to Chinese citizens living abroad.
  3. PIPL applies only to state organs.
  4. PIPL may apply where processing outside China is for the purpose of providing products or services to individuals in China or analyzing their behavior. Correct answer.

Explanation

PIPL has extraterritorial reach: processing outside China that aims to provide products or services to individuals in China, or to analyze or assess their behavior, falls within its scope. Such overseas processors must establish a dedicated entity or representative in China and comply with PIPL.

Question 22Basics of the Personal Information Protection Law

PIPL requires processors to adopt necessary measures to ensure the security of personal information. Which measure is expressly mentioned?

  1. Publishing all data publicly
  2. Encryption and de-identification Correct answer.
  3. Storing data only on personal devices
  4. Sharing passwords among all staff

Explanation

PIPL lists security measures including encryption and de-identification, internal management systems, classification, access controls, staff training, and contingency plans. These measures aim to prevent unauthorized access, leakage, distortion, or loss.

Question 23Basics of the Personal Information Protection Law

A processor wants to use personal information for direct marketing. Under PIPL, what is required?

  1. Automatic enrollment of all customers
  2. No consent under any circumstances
  3. Consent where the individual has not been informed, with a clear and easy way to opt out Correct answer.
  4. Publishing the marketing list publicly

Explanation

PIPL requires consent for processing personal information for marketing where the individual has not been informed or has not consented, and individuals must be given a clear, easy way to refuse or withdraw. Marketing must not use personal information beyond the agreed scope.

Question 24Basics of the Personal Information Protection Law

Which statement best captures PIPL's rule on processing personal information of minors under 14?

  1. It is freely permitted without any special condition.
  2. It is prohibited entirely.
  3. It requires only the minor's own oral consent.
  4. It is treated as sensitive personal information requiring guardian consent. Correct answer.

Explanation

PIPL treats personal information of minors under 14 as sensitive personal information and requires the consent of the minor's guardian. Processors must also adopt special processing rules for this information.

Question 25Basics of the Personal Information Protection Law

A controller receives a request from an individual to obtain a copy of their personal information. How must the controller respond under PIPL?

  1. Charge a fee equal to the company's profit margin
  2. Require the individual to file a lawsuit first
  3. Provide the copy promptly unless a law or regulation provides otherwise Correct answer.
  4. Refuse because copies are never allowed

Explanation

PIPL grants individuals the right to access and obtain a copy of their personal information, and the processor must provide it promptly. Refusal is permitted only where a law or regulation provides otherwise, and exercising this right should not be obstructed.

Question 26Basics of the Personal Information Protection Law

Under PIPL, which term designates the entity that independently determines the purposes and means of processing personal information?

  1. Personal information processor Correct answer.
  2. Entrusted party
  3. Personal information recipient
  4. Personal information handler

Explanation

PIPL uses the term personal information processor (个人信息处理者) for the entity that decides the purposes and means of processing on its own. This status is what triggers the law's core obligations, such as lawful basis, security measures, and accountability.

Question 27Basics of the Personal Information Protection Law

Which of the following is listed by PIPL as a lawful basis for processing personal information without obtaining consent?

  1. Necessary to conclude or perform a contract to which the individual is a party Correct answer.
  2. Necessary to enrich the processor's internal analytics dashboard
  3. Necessary to benchmark the processor against competitors
  4. Necessary to improve the processor's marketing conversion rates

Explanation

PIPL Article 13 enumerates specific grounds that permit processing without consent, and one of them is necessity for concluding or performing a contract to which the individual is a party. Commercial optimization goals such as marketing, analytics, or benchmarking are not among the enumerated grounds.

Question 28Basics of the Personal Information Protection Law

PIPL classifies certain data as sensitive personal information. Which item is expressly included in that category?

  1. Company registration number
  2. Office email address
  3. Product serial number
  4. Biometric characteristics Correct answer.

Explanation

Sensitive personal information under PIPL includes biometric characteristics, religious beliefs, specific identity, medical health, financial accounts, and location tracking, as well as data of minors under 14. Biometric data is expressly named because misuse can readily harm personal dignity or property.

Question 29Basics of the Personal Information Protection Law

For processing sensitive personal information, PIPL requires which additional element beyond the ordinary consent standard?

  1. Approval from the local industry association
  2. Notarization of the privacy notice
  3. Filing of the consent form with the tax authority
  4. Separate consent obtained from the individual Correct answer.

Explanation

PIPL requires separate consent (单独同意) for sensitive personal information, meaning consent must be obtained specifically for that processing rather than bundled into general terms. A written notice of necessity and impact on rights is also required, but external approvals or notarization are not.

Question 30Basics of the Personal Information Protection Law

PIPL sets a general rule on the location where personal information collected and generated within China should be stored. What does the law provide?

  1. It must always be stored outside China to reduce local risk
  2. It must be stored in the processor's country of incorporation only
  3. It may be stored anywhere without any conditions
  4. It should be stored within China, subject to the cross-border transfer rules Correct answer.

Explanation

PIPL establishes that personal information collected and generated within China should in principle be stored within China. Transfer abroad is permitted only when the specific cross-border mechanisms, such as security assessment, certification, or standard contract, are satisfied.

Question 31Basics of the Personal Information Protection Law

Which government body is charged by PIPL with coordinating personal information protection work nationwide?

  1. The Ministry of Commerce
  2. The People's Bank of China
  3. The National Development and Reform Commission
  4. The Cyberspace Administration of China Correct answer.

Explanation

PIPL assigns the Cyberspace Administration of China the role of coordinating personal information protection across the country and handling related supervision. Other departments carry out protection duties within their respective scopes.

Question 32Basics of the Personal Information Protection Law

Under PIPL, what is the general age threshold below which a person's personal information is treated as sensitive personal information?

  1. Under 16 years of age
  2. Under 14 years of age Correct answer.
  3. Under 18 years of age
  4. Under 12 years of age

Explanation

PIPL treats the personal information of minors under 14 as sensitive personal information. Processing it requires consent from the minor's parents or other guardians and a dedicated processing rule.

Question 33Basics of the Personal Information Protection Law

Which of the following is one of the individual rights expressly granted by PIPL?

  1. The right to know and decide on the processing of one's personal information Correct answer.
  2. The right to receive monetary compensation for any data processing
  3. The right to veto any processing by state authorities
  4. The right to demand deletion of all public records about oneself

Explanation

PIPL grants individuals the right to know and decide on the processing of their personal information, along with related rights such as access, copying, correction, and deletion. These rights are limited to personal information and do not extend to public records generally or to automatic compensation.

Question 34Basics of the Personal Information Protection Law

A processor relies on consent as its lawful basis. Which statement best reflects PIPL's requirement on how consent must be obtained?

  1. Consent may be presumed once the individual continues to use a service after a notice is posted
  2. Consent must be voluntary and based on full information, and the individual must be able to withdraw it Correct answer.
  3. Consent remains valid indefinitely once obtained and cannot be withdrawn
  4. Consent must be obtained in writing in all cases regardless of context

Explanation

PIPL requires consent to be given voluntarily and with full information, and it grants the individual the right to withdraw consent. Withdrawal must be facilitated, and processing based on consent should stop once consent is withdrawn.

Question 35Basics of the Personal Information Protection Law

A processor wants to rely on the ground that processing is necessary to respond to a public health emergency. What does PIPL require in such a situation?

  1. The processor must transfer the data abroad for safety
  2. The processor must obtain separate consent from every affected individual
  3. The processor must suspend all processing until the emergency ends
  4. The processing must be limited to the scope necessary to respond to the emergency Correct answer.

Explanation

PIPL permits processing without consent where necessary to respond to a public health emergency or to protect life, health, or property in an emergency. The processing must remain within the scope and necessity of that emergency response.

Question 36Basics of the Personal Information Protection Law

A processor plans to publish a privacy policy that bundles many unrelated processing purposes into one long document. Which PIPL principle is most directly engaged?

  1. Processing must always be free of charge to the individual
  2. Processing must be documented in a foreign language for international users
  3. Processing must be approved by a trade association before publication
  4. Processing must be clear and transparent, with purposes and methods explicit Correct answer.

Explanation

PIPL requires processing to be clear and transparent, with the purpose and method of processing made explicit. Bundling unrelated purposes into one opaque document undermines that transparency and informed consent.

Question 37Basics of the Personal Information Protection Law

A processor collects personal information for a loyalty program. Which PIPL principle limits how much data it may collect for that purpose?

  1. Collection should be limited to the minimum scope necessary for the stated purpose Correct answer.
  2. Collection should be maximized to reduce the number of future requests
  3. Collection should be as broad as possible to support future growth
  4. Collection should prioritize data that competitors do not hold

Explanation

PIPL requires that the collection of personal information be limited to the minimum scope necessary to achieve the processing purpose. Collecting extra data for speculative future uses is inconsistent with that principle.

Question 38Basics of the Personal Information Protection Law

An individual asks a processor to explain the rules governing its automated decision-making. What does PIPL provide in this situation?

  1. The individual has the right to request an explanation and to refuse processing based solely on automated decision-making Correct answer.
  2. The individual may request deletion of the algorithm but not an explanation
  3. The individual may only request an explanation after filing a lawsuit
  4. The individual must accept the automated decision because it is technical

Explanation

PIPL grants individuals the right to request explanations of automated decision-making rules and the right to refuse decisions made solely through automated means where those decisions significantly affect their rights. The processor must provide a means to opt out or otherwise address the request.

Question 39Basics of the Personal Information Protection Law

A processor receives a request from an individual to explain what personal information it holds about them. Which response is consistent with PIPL?

  1. Charge a prohibitive fee to discourage the request
  2. Provide the information and explain the processing rules in a timely manner Correct answer.
  3. Refuse because internal records are confidential by default
  4. Delay indefinitely until the individual escalates to court

Explanation

PIPL grants individuals the right to access and copy their personal information and to be informed of the processing rules. The processor must respond promptly and cannot rely on blanket confidentiality or obstructive fees.

Question 40Basics of the Personal Information Protection Law

A processor's employee accidentally exposes a customer database. Which action best reflects PIPL's immediate notification duty?

  1. Notify only the processor's board of directors
  2. Notify the relevant authority and the affected individuals without delay Correct answer.
  3. Wait for the affected individuals to discover the exposure themselves
  4. Notify the media first and the authority later

Explanation

PIPL requires the processor to immediately take remedial measures and to notify the authority and affected individuals of a leak, loss, or tampering of personal information. Notification must include the categories of information, possible consequences, and remedial measures taken.

Question 41Basics of the Personal Information Protection Law

A processor intends to install cameras in a workplace rest area for security monitoring. How should PIPL analysis treat this plan?

  1. It should be limited to necessary areas and accompanied by clear notice, since rest areas raise privacy concerns Correct answer.
  2. It is always permitted because security is a legitimate interest
  3. It is prohibited in all workplaces without exception
  4. It requires no notice because employees have consented by contract

Explanation

PIPL requires processing to be necessary and proportionate and to provide clear notice of the purpose and method. Monitoring rest areas is likely excessive and should be avoided or confined to genuinely necessary areas with proper notice.

Question 42Basics of the Personal Information Protection Law

A processor plans to process personal information of children under 14. Which additional obligation applies under PIPL?

  1. Obtain a court order authorizing the processing
  2. Obtain consent from parents or other guardians and adopt a dedicated processing rule Correct answer.
  3. Obtain consent from the child alone, since children can decide for themselves
  4. Obtain approval from the local education bureau before any processing

Explanation

PIPL treats the personal information of minors under 14 as sensitive and requires consent from parents or other guardians. The processor must also adopt a dedicated rule for handling such information.

Question 43Basics of the Personal Information Protection Law

A processor plans to use personal information for a purpose that is not covered by the original consent but is closely related to it. What does PIPL require?

  1. Obtain consent only if the individual complains
  2. Obtain fresh consent, unless another statutory ground applies Correct answer.
  3. Proceed without consent because the new purpose is related
  4. Obtain approval from the processor's marketing department

Explanation

PIPL requires that processing stay within the scope of the original consent and that a new purpose generally requires new consent unless another lawful basis applies. Relatedness alone does not dispense with the need for a lawful basis.

Question 44Basics of the Personal Information Protection Law

A processor intends to disclose personal information to a third party. What does PIPL require before the disclosure?

  1. Inform the individual of the recipient's name and contact details and obtain separate consent Correct answer.
  2. Rely on the original general consent without further steps
  3. Obtain approval from the recipient's competitors
  4. Post a notice on the recipient's website after disclosure

Explanation

PIPL requires the processor to inform the individual of the recipient's identity and contact information and to obtain separate consent for the disclosure. General bundled consent does not cover a new third-party disclosure.

Question 45Basics of the Personal Information Protection Law

A processor wants to use personal information for direct marketing by SMS. What does PIPL require?

  1. Obtain consent and provide a clear, convenient way to opt out Correct answer.
  2. Rely on the individual's silence as consent
  3. Send messages until the individual complains
  4. Obtain consent from the individual's employer

Explanation

PIPL requires consent for direct marketing and provides the individual with the right to refuse or withdraw consent. The processor must offer a clear and convenient opt-out mechanism and stop upon refusal.

Question 46Basics of the Personal Information Protection Law

A foreign company processes personal information of individuals located in China from outside China for the purpose of providing goods to them. Which statement about PIPL's reach is correct?

  1. PIPL applies only if the company has a physical office in China
  2. PIPL applies only if the individuals are Chinese nationals
  3. PIPL applies, and the company must establish a dedicated entity or representative in China Correct answer.
  4. PIPL does not apply because the company is incorporated abroad

Explanation

PIPL has extraterritorial reach where processing outside China is directed at providing products or services to individuals in China or analyzing their behavior. In such cases the processor must set up a dedicated entity or representative in China to handle protection matters.

Question 47Basics of the Personal Information Protection Law

An individual requests deletion of personal information that the processor collected in breach of law. How should the processor respond under PIPL?

  1. Delete only the individual's account but keep the underlying records
  2. Require the individual to pay a deletion fee
  3. Delete the information promptly and notify any recipients who received it Correct answer.
  4. Retain it indefinitely because deletion is technically difficult

Explanation

PIPL requires deletion where the processing violates law or the agreed purpose, among other grounds. The processor must act promptly and, where feasible, inform recipients of the deletion so that they also take action.

Question 48Basics of the Personal Information Protection Law

A processor plans to conduct a personal information protection impact assessment (PIPIA) before a high-risk processing activity. Which element must the assessment address?

  1. The salaries of the processor's executives
  2. The processor's stock price forecast
  3. The processor's projected marketing revenue
  4. The impact on individuals' rights and the security measures to be taken Correct answer.

Explanation

PIPL requires the PIPIA to cover whether the processing purpose and method are lawful and justified, the impact on individuals' rights, and the security measures adopted. Financial metrics unrelated to personal information protection are not part of the assessment.

Question 49Basics of the Personal Information Protection Law

A processor is subject to a regulatory investigation for a suspected violation of PIPL. Which statement best describes the processor's position during the investigation?

  1. It may refuse to cooperate because its data is proprietary
  2. It may continue the unlawful processing until a final judgment
  3. It may destroy relevant records to avoid liability
  4. It must cooperate and provide necessary assistance, and may face penalties including fines and suspension Correct answer.

Explanation

PIPL empowers authorities to investigate and requires processors to cooperate and provide assistance. Violations can lead to fines, suspension of service, and other sanctions, and obstructing or destroying evidence aggravates liability.

Question 50Basics of the Personal Information Protection Law

A processor's security system is breached and the personal information of many individuals is exposed. Which combination of obligations is correctly stated under PIPL?

  1. Take immediate remedial measures, notify the authority and individuals, and report the categories and consequences of the breach Correct answer.
  2. Notify the individuals only after a year to allow investigation
  3. Take no action if the breach was caused by an external attacker
  4. Notify only the processor's shareholders and take no further action

Explanation

PIPL requires immediate remedial measures and notification of the authority and affected individuals, including the categories of information, possible consequences, and remedial measures. The processor must also report on its handling of the breach.