EXIN PDPF study guide
EXIN PDPF · Work through your exam, one topic at a time.
The EXIN Privacy & Data Protection Foundation based on PIPL is a Foundation-level certification on China's Personal Information Protection Law (中华人民共和国个人信息保护法), passed by the Standing Committee of the 13th National People's Congress on August 20, 2021. EXIN states that the certification equips candidates with local knowledge of what the PIPL is and how to lawfully process and protect personal data, and that it also supports comparison of PIPL principles with the GDPR for those who process data across multiple markets. EXIN positions it for anyone who must know or stay updated on privacy and personal information protection as mandated by local law, naming Data Protection Officers, Information Security Officers, Chief Data Officers, Compliance Officers, and lawyers and legal professionals. The exam is one hour, 40 multiple-choice questions, with a 65% pass mark, closed book, no electronic equipment allowed, and it carries 2 ECTS credits. The EXIN PDPF study guide has 3 sections and about 1,484 words.
01Basics of the Personal Information Protection Law
This domain tests the architecture of China's Personal Information Protection Law (PIPL): what it covers, who it binds, what counts as personal information, and which legal ground justifies processing. Expect precise definitions and careful reading of scope rather than GDPR vocabulary imported wholesale.
488 words, about 2 min02Processing of Personal Information
This domain covers the operating rules: when processing is permitted, what valid consent looks like, how data may be shared or sent abroad, and which assessments must precede risky processing. Consent must be voluntary, explicit and informed, given on a clear basis.
495 words, about 2 min03Ensuring Personal Information is Protected
This domain tests security and accountability: how PI must be safeguarded, who is responsible, what happens after a breach, and the penalties that follow non-compliance. Processors must adopt internal management rules, classify data, encrypt and de-identify where appropriate, train staff, set contingency plans and audit their own handling.
501 words, about 3 min