China Data Protection Practice and Compliance
Build the compliance program
Start with a data inventory: systems, purposes, data categories, retention, vendors, and cross-border flows. Classify PI, sensitive PI, and important data separately; important data is a DSL concept and can include non-PI. Map legal bases to each purpose. Draft layered notices that state the processor’s identity, purposes, methods, categories, retention, rights, and complaint channel.
Consent and vendor operations
Consent must be granular. Use separate consent for sensitive PI, third-party provision, public disclosure, and cross-border transfer. Withdrawal must be as easy as giving consent. Minors under 14 require guardian consent and dedicated rules. For entrusted processing, sign an Article 21 agreement covering purpose, period, method, data types, security measures, and supervision; the entrusting party remains liable. If a vendor determines its own purposes, it is a separate processor and triggers Article 23 disclosure and separate consent. SDKs need special diligence because data flows are often opaque.
Rights, risk, and incidents
Operate a rights channel with identity verification, case logging, and deletion workflows. Retain PI only as long as necessary. Run a PIPIA before sensitive PI processing, automated decision-making, entrusting, third-party provision, public disclosure, cross-border transfer, and other high-risk activities; retain the report and records for at least three years. Maintain an incident playbook covering containment, assessment, regulator and individual notification, and remediation.
Worked example
A shopping app embeds an analytics SDK and a marketing SDK. The analytics SDK processes device IDs only on the app’s instructions: treat it as an entrusted processor, sign the Article 21 agreement, and audit it. The marketing SDK builds its own audience profiles: treat it as a separate recipient, disclose its identity and purposes, and obtain separate consent. If precise location is collected, that is sensitive PI, so add separate consent and a PIPIA. Personalized ads need an opt-out that is easy to find.
Traps
- Using the privacy policy as blanket consent.
- Assuming a vendor contract removes the app’s liability.
- Missing SDK onward flows.
- Treating employee consent as always freely given.
- Assuming a fixed statutory DSAR deadline; PIPL requires a mechanism, not a GDPR-style one-month rule.