Processing of Personal Information
What this domain tests
This domain covers the operating rules: when processing is permitted, what valid consent looks like, how data may be shared or sent abroad, and which assessments must precede risky processing.
Consent mechanics
Consent must be voluntary, explicit and informed, given on a clear basis. Separate consent is required for providing PI to another processor (Article 23), public disclosure (25), sensitive PI (29, together with notice of necessity and impact on rights) and cross-border transfer (39). If purpose, method or data type changes, consent must be obtained again. Withdrawal must be as easy as granting consent. For minors under 14, the guardian consents and specific processing rules apply.
Sharing and outsourcing
- Entrustment (Article 21): an agreement fixes purpose, period, method, data types and security measures; the processor supervises the work, and the entrusted party cannot sub-entrust without consent.
- Joint processing (Article 20): parties agree on rights and obligations, which cannot undercut individuals' rights.
- Third-party provision (Article 23): inform the recipient's identity and contact details, purpose, method and data types, then obtain separate consent; the recipient must stay inside that scope.
- Publicly disclosed PI (Article 27): may be processed within a reasonable scope, but consent is needed where processing would significantly affect the individual.
Automated decisions and transfers
Article 24 requires transparency and fairness, bans unreasonable differential treatment, and requires an option that does not target personal characteristics plus a convenient refusal route. Decisions with significant impact must be explainable and refusable. Cross-border transfers need an Article 38 route (CAC security assessment, certification, or standard-contract filing) plus Article 39 separate consent and notice of the recipient, purpose and rights. Critical information infrastructure operators and processors above the volume threshold must store data in China.
Impact assessments
A personal information protection impact assessment is required for sensitive PI, automated decision-making, entrustment, third-party provision, public disclosure, cross-border transfer and other high-risk processing. Reports are kept for three years.
Worked example
An e-commerce platform shares order data with a courier, profiles customers for targeted ads, and stores data on an overseas cloud. Whether the courier is an entrusted party or an independent processor depends on who decides purpose; either way a contract and notice are needed. Profiling triggers Article 24 and an impact assessment, and the cloud transfer needs an Article 38 route plus separate consent.
Traps
- Using ordinary consent where separate consent is required.
- Skipping the impact assessment because consent exists.
- Forgetting that recipients are bound to the notified scope.