Ensuring Personal Information is Protected
What this domain tests
This domain tests security and accountability: how PI must be safeguarded, who is responsible, what happens after a breach, and the penalties that follow non-compliance.
Security programme (Article 51)
Processors must adopt internal management rules, classify data, encrypt and de-identify where appropriate, train staff, set contingency plans and audit their own handling. Article 52 requires a person responsible for PI protection where processing volume reaches the threshold set by the Cyberspace Administration of China. Overseas processors must designate a local dedicated body or representative and file the details (Article 53). Article 54 requires regular compliance audits, plus any audit the regulator orders. Large internet platforms have extra duties under Article 58, including an independent oversight body and social responsibility reporting.
Breach response (Article 57)
On leakage, alteration or loss, the processor must immediately remediate and notify the regulator and affected individuals. The notice must cover the data categories involved, the likely cause, possible harm, remedial measures and contact details. Notification to individuals may be omitted where it is unnecessary to avoid harm, but the regulator can still require it.
Rights and remedies
Articles 44-50 give individuals rights to know and decide, access and copy, portability, correction and completion, deletion and explanation, exercised through a convenient mechanism; refusals must be explained. Deletion applies when the purpose is achieved, the service ends or retention expires, consent is withdrawn, or processing was unlawful. Article 69 presumes fault in civil claims, and public interest litigation is possible under Article 70.
Penalties
Article 66 provides correction orders, warnings, confiscation of illegal income and fines up to RMB 1 million; for serious violations, fines up to RMB 50 million or 5% of prior-year turnover, suspension, licence revocation, and personal fines of RMB 100,000 to 1 million for responsible individuals. Criminal liability can follow under Article 71.
Worked example
A hospital finds that an unencrypted server exposed patients' health records. Health data is sensitive PI, so the hospital must immediately contain the exposure and notify both the regulator and affected patients with the required content. It should also check whether its Article 51 measures and any required impact assessment were in place, and expect fault-based civil claims if patients suffer loss.
Traps
- Notifying only the regulator and not individuals.
- Importing the GDPR's 72-hour deadline; PIPL requires immediate action, not a fixed window.
- Assuming only breaches create liability; missing audits or a DPO also count.
- Believing the maximum fine is RMB 1 million.