IAPP CIPP/CN flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

PIPL effective date

China's Personal Information Protection Law took effect on 1 November 2021, becoming the country's first comprehensive national law dedicated to personal information protection.

PIPL personal information definition

Article 4 defines personal information as information related to an identified or identifiable natural person, excluding anonymized information; anonymization must be impossible to reverse.

Sensitive personal information categories

Article 28 lists biometric data, religious belief, specific identity, medical health, financial accounts, location tracking, and PI of minors under 14 as sensitive personal information.

Article 13 lawful bases

Lawful bases include consent, contract necessity, statutory duty, public health or emergency, public interest reporting, already-disclosed information within reasonable scope, and other laws.

Separate consent triggers

Separate consent is required for sensitive PI, providing PI to other processors, public disclosure, cross-border transfer, and automated decision-making with significant impact.

Automated decision-making rules

Article 24 requires transparent rules, fair outcomes, no unreasonable differential treatment, and opt-out or human-explanation rights for decisions with significant impact.

PIPL extraterritorial scope

PIPL applies outside China where processing serves the purpose of providing products or services to individuals in China or analyzing/evaluating behavior of individuals in China.

GB/T 35273 standard

A voluntary national standard, the Personal Information Security Specification, widely used as a de facto compliance benchmark by regulators and auditors in China.

PIPL maximum fine

For serious violations, fines may reach RMB 50 million or 5% of prior-year turnover, whichever is higher; responsible individuals may be fined up to RMB 1 million.

Lead data regulator

The Cyberspace Administration of China (CAC) leads data protection enforcement, with MIIT, Ministry of Public Security, SAMR, and PBOC acting within their sectors.

Article 66 triggers

Serious-violation triggers include unlawful processing causing serious consequences such as large-scale infringement or major data breaches, justifying maximum penalties.

App PI collection campaigns

CAC campaigns in 2021 and 2022 targeted illegal app collection of personal information; operators were ordered to rectify and non-compliant apps removed from stores.

Didi enforcement case

The 2021 Didi case resulted in a RMB 8.026 billion fine and a two-year suspension of new user registration, illustrating national-security-linked enforcement.

Article 57 breach notification

Requires immediate remedial action and notification to the authority and affected individuals; individual notification may be avoided if harm is effectively prevented.

PBOC fintech enforcement

The 2022-2023 Ant Group and related fintech penalties show financial regulators enforcing PI and data rules alongside financial regulation.

Article 69 civil liability

Individuals may sue under a fault-based liability standard, with the processor bearing burden of proof to show it was not at fault.

Data classification tiers

Data is classified as general PI, sensitive PI, important data, or core data; classification drives consent, security, and transfer obligations.

Valid consent standard

Consent must be voluntary, explicit, informed, and separate from bundled terms; pre-ticked boxes and default consent are invalid.

Privacy notice contents

Notices must state the processor's identity, purpose, method, categories, retention period, and how individuals exercise their rights.

Individual rights list

Rights include access, copy, correction, deletion, withdrawal of consent, data portability, and explanation of automated decisions.

PIPIA triggers

Impact assessments are required for sensitive PI, automated decision-making, entrusting or providing PI to third parties, public disclosure, and cross-border transfers; records kept at least three years.

PIPO threshold

A Personal Information Protection Officer is required for processors exceeding the CAC volume threshold, currently 1 million individuals' PI, and must be reported to the regulator.

Entrusted party contracts

Vendor contracts must specify purpose, duration, method, data categories, security measures, and prohibit sub-entrusting without the processor's consent.

MLPS 2.0

The Cybersecurity Law Multi-Level Protection Scheme classifies systems by security level and imposes controls, widely used as the baseline for PI security measures.

Breach response steps

Containment, internal escalation, regulator notification, individual notification where harm is likely, and post-incident review.

Article 38 transfer mechanisms

Cross-border transfer mechanisms: CAC security assessment, CAC-filed standard contract, certification by a professional body, or other conditions set by law.

Security assessment triggers

Mandatory for CIIOs, important data, and PI of more than 1 million individuals, with thresholds adjusted by the 2024 Provisions.

Standard contract filing

Requires the CAC template, a PI protection impact assessment, and filing with the provincial CAC within 10 working days of signing.

2024 cross-border provisions

Allow exemptions for international trade, academic cooperation, and emergencies, and permit free-trade zones to adopt negative lists.

Important data definition

Defined by sectoral catalogs and regulator designations; absent a designation, data is generally not treated as important data under 2024 guidance.

CIIO obligations

Critical information infrastructure operators must localize PI and important data, conduct annual security assessments, and obtain CAC security assessment for any outbound transfer.

Article 41 foreign requests

Foreign law enforcement or judicial requests for data stored in China require approval from Chinese authorities; unsanctioned provision is prohibited.