IAPP CIPP/CN key terms

China's comprehensive personal information protection statute effective November 2021, setting rules for processing, individual rights, cross-border transfer, and penalties. It operates alongside the Cybersecurity Law and Data Security Law.

China's 2017 law establishing network security obligations, including the multi-level protection scheme, real-identity requirements, and data localization for critical information infrastructure operators. It predates PIPL and remains a core pillar of the framework.

China's 2021 law governing data security generally, creating a classified data protection regime, security review for data transactions with foreign parties, and obligations for important data handlers. It applies to data beyond personal information.

Information recorded electronically or otherwise that relates to an identified or identifiable natural person, excluding anonymized information. PIPL protects this category and treats de-identified data as still regulated.

Personal information that, if leaked or misused, may easily harm personal dignity or property, such as biometric, religious, medical, financial, location, and minors' data. It requires specific purpose, strict necessity, separate consent, and a personal information protection impact assessment.

A consent standard under PIPL requiring a distinct, standalone affirmative act for specified high-risk processing, rather than bundling it into general privacy terms. It applies to sensitive information, sharing with third parties, public disclosure, and cross-border transfers.

The baseline lawful basis under PIPL: the handler must inform the individual of the processor's identity, purposes, methods, categories, retention, and rights, and obtain consent. Consent must be voluntary and based on full information.

The entity that independently determines the purpose and method of personal information processing. Under PIPL this role carries the main compliance obligations, including consent, impact assessments, breach notification, and cross-border compliance.

An entity that processes personal information on behalf of a handler, following the handler's instructions and bound by contract. It may not process beyond instructions and must assist the handler in meeting individual rights requests.

A contract required when a handler entrusts processing to another party, specifying scope, purpose, duration, protection measures, and both parties' duties. The handler must supervise the entrusted party's processing.

A documented assessment required before high-risk processing, such as sensitive information handling, automated decision-making, entrusting, sharing, or cross-border transfer. It must cover legality, necessity, impact on rights, and protection measures, with records kept at least three years.

Transferring personal information outside mainland China, permitted only through a security assessment, certification, standard contract filing, or another statutory route, and only after informing the individual and obtaining separate consent.

The security assessment administered by the Cyberspace Administration of China for certain outbound data transfers, required for critical information infrastructure operators, important data, and large-volume personal information transfers. It examines necessity, recipient safeguards, and legal environment.

A prescribed contract route allowing eligible handlers to export personal information by filing a standard-form contract with the provincial cyberspace authority. It is available only to parties below statutory volume and data-sensitivity thresholds.

A certification route for cross-border transfers under PIPL, where a qualified institution certifies that the handler's transfer activities meet protection standards. It is one of the lawful mechanisms for exporting personal information.

An operator of critical information infrastructure in sectors such as energy, finance, telecom, and transport, designated under the CSL. CIIOs face stricter duties, including local storage of personal information and mandatory security assessment for outbound transfers.

Data that, if tampered with, destroyed, leaked, or illegally obtained, may harm national security, economic operation, social stability, or public health and safety. Its export requires security assessment and stricter handling duties.

The highest tier in China's data classification system, covering data relating to national security, the lifelines of the economy, and major public interests. It receives the strictest protection and is generally subject to heightened state control.

China's mandated system for classifying data by industry and grading it by importance, from general to important to core data. Organizations must build inventories and apply protection levels accordingly under the DSL.

Processing that removes or replaces identifiers so that personal information cannot identify an individual without additional information kept separately. De-identified data remains personal information under PIPL and stays within scope.

Processing that makes information impossible to identify a specific natural person and cannot be reversed. Anonymized information falls outside PIPL's scope, unlike de-identified data that can be re-linked.

PIPL grants individuals rights to access, copy, correct, and delete their personal information, plus portability and explanation requests. Handlers must respond within a reasonable period and provide channels to exercise them.

An individual's right to withdraw consent at any time, after which the handler must stop processing based on that consent. Withdrawal does not affect processing lawfully carried out before withdrawal.

The duty to notify the regulator and affected individuals promptly when personal information is or may be leaked, altered, or lost. Notification must describe the incident, possible harm, and remedial measures, unless harm is effectively avoided.

Using computer programs to automatically analyze or evaluate personal characteristics and make decisions, such as profiling or personalized pricing. PIPL requires transparency, fairness, an opt-out, and a refusal right for decisions with significant impact.

The Cyberspace Administration of China, the lead regulator coordinating personal information protection and cross-border data transfer. It issues implementing rules, runs security assessments, and enforces alongside sector regulators.

A mandated periodic review of an organization's personal information processing against PIPL and related rules, examining compliance of policies, consent records, and safeguards. Findings must be remediated and documented.

A designated person responsible for supervising personal information processing and protection measures, required for handlers above a statutory volume threshold. The role coordinates compliance, training, and regulator contact.

A large online platform designated under PIPL rules that must establish an independent oversight body for personal information protection. It also faces enhanced duties on platform rules, algorithm transparency, and third-party management.

The movement of data from mainland China to another jurisdiction, covering both personal information and important data. Each route has distinct triggers, filing steps, and contractual or assessment requirements.

The requirement that certain data be stored within China, notably personal information collected by critical information infrastructure operators and important data. Cross-border transfer then requires a statutory mechanism.

China's multi-level protection scheme requiring network operators to classify systems by security level and implement corresponding safeguards, with filing and testing duties. It underpins CSL compliance and is often assessed alongside PIPL.

An incident affecting network or data security, such as a breach, intrusion, or service disruption. Operators must have response plans, report serious incidents, and preserve evidence for investigation.

Enforcement measures under PIPL ranging from warnings and rectification orders to fines, suspension of service, and revocation of business licenses. Serious violations can bring fines up to RMB 50 million or 5% of prior-year turnover.

A lawsuit brought by procuratorates or designated organizations against handlers that harm many individuals' personal information rights. PIPL expressly authorizes this mechanism for public-interest protection.

The principle that processing must be limited to the minimum scope and frequency needed for a specified purpose, with collection restricted to directly relevant information. It is a core legality test under PIPL.

The rule that personal information must be collected for a clear, reasonable purpose and not used for purposes incompatible with the original one. Changes require a new lawful basis and notice.

PIPL extends protection to personal information of deceased persons, allowing close relatives to exercise access, correction, and deletion rights for their own lawful, legitimate interests, unless otherwise arranged by the deceased.

Personal information of minors under fourteen, treated as sensitive and requiring guardian consent. Handlers must adopt special rules and protect minors' data with heightened care.

Administrative regulations implementing the CSL, DSL, and PIPL, detailing data classification, cross-border transfer procedures, incident response, and platform duties. They clarify operational steps regulators expect organizations to follow.