PrivacyChina

China Privacy Law PIPL entrusted processing and vendor contracts

How to document entrusted processing, vendor responsibilities, contract controls, and evidence under PIPL.

Use Article 21 only when the vendor processes personal information within the appointing processor's documented purpose and method. A recipient that determines its own purpose or method needs a different PIPL analysis.

Back to main artifact Review sources

Author

Sorena AI

Published

Jul 5, 2026

Updated

Jul 24, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Jul 5, 2026

Updated Jul 24, 2026

Overview

Treat a vendor as an under PIPL Article 21 only when it handles personal information for the appointing personal information processor and stays within the agreed purpose and method. The parties must document the required terms, the appointing processor must supervise the vendor, and the vendor must return or delete the information when the appointment ends. If the recipient determines a purpose or method for itself, analyze Article 23 provision to another personal information processor instead of labeling the relationship as entrustment.

Section 1

1. Classify the relationship by what each party actually does

Record who decides why the personal information is processed, which information is used, how it is processed, how long it is kept, and whether either party may use it for its own analytics, product development, advertising, or other purpose. For example, hosting records only on the customer's documented instructions can fit entrustment, while reusing those records to build the vendor's own advertising profile points to an independent purpose that requires reclassification. The actual facts control; contract labels such as vendor, service provider, processor, or partner do not answer the question.

Article 21 applies to instructed processing. Article 23 applies when one personal information processor provides personal information to another: the disclosing processor must give the required recipient notice and obtain separate consent, and the recipient must stay within the notified purpose, method, and categories unless it obtains consent again as required. If two parties jointly decide purpose and method, Article 20 requires them to allocate their rights and duties and can expose them to joint liability for harm.

Entrustment: the appointing processor sets the boundaries and supervises; the entrusted party processes within the agreement.
Provision to another processor: the recipient has its own processing role, so Article 23 notice, separate consent, and purpose limits require separate treatment.
Joint processing: both parties decide purpose and method and must allocate their duties without restricting an individual's statutory rights.
Overseas access or transfer: run the PIPL cross-border analysis in addition to the domestic role analysis. Entrustment does not exempt a transfer from Article 38 or the current CAC export rules.

Sources for this answer

PRC Personal Information Protection Law

Articles 20, 21, 23, 38-39, 55-56, and 59 distinguish joint processing, entrustment, provision to another processor, overseas transfer, impact assessment, and entrusted-party security duties.

Section 2

2. Put the Article 21 minimum terms into the contract

The entrustment agreement must state the processing purpose, duration, method, personal information categories, protection measures, and each party's rights and duties. It should turn those boundaries into instructions and evidence that can be checked during supervision.

Define permitted operations, systems, access locations, user groups, retention, deletion, return, and the response to individual-rights requests.
Require the vendor to stay within the agreed purpose and method. If the agreement is ineffective, invalid, revoked, or terminated, require return or deletion and prohibit retention.
Prohibit further entrustment without the appointing processor's consent. Record each approved sub-entrusted party, its scope, location, safeguards, and termination handling.
Require necessary security measures and assistance with the appointing processor's PIPL duties, including rights requests and personal information incidents. Article 59 imposes these duties on the entrusted party directly.
Add audit, evidence-access, remediation, incident-notification, and deletion-confirmation mechanics that let the appointing processor perform its Article 21 supervision duty. These mechanics implement the duty; PIPL does not prescribe one universal clause set.

Sources for this answer

PRC Personal Information Protection Law

Article 21 lists the required entrustment subjects, processing limits, return or deletion rule, sub-entrustment restriction, and supervision duty; Article 59 covers security and assistance.

Section 3

3. Assess, approve, and monitor the appointment

PIPL Article 55 requires a personal information protection impact assessment before entrusting personal information. The assessment must test legality, legitimacy, and necessity; effects on individuals and security risks; and whether the safeguards are lawful, effective, and proportionate to the risk. Retain the assessment report and processing record for at least three years.

Before access begins, retain the role analysis, data-flow and category inventory, vendor security review, Article 55 assessment, approved agreement, and evidence that access matches the approved scope.
During the appointment, review access, incidents, rights-request support, sub-entrustment, security findings, remediation, and changes in purpose, method, categories, location, recipient, retention, or law.
At termination, disable access and obtain evidence of return or deletion for the vendor and approved sub-entrusted parties. Article 21 says the entrusted party may not retain the information when the entrustment contract is ineffective, invalid, revoked, or terminated; do not add a generic vendor-retention exception without identifying another controlling legal rule.
Reclassify and reassess the arrangement if the vendor begins determining a purpose or method, using information for itself, adding an overseas access path, or changing a material processing fact.

Sources for this answer

PRC Personal Information Protection Law

Articles 55-56 require a pre-processing impact assessment for entrustment, state its minimum subjects, and require the report and processing record to be retained for at least three years.

Operationalize the requirement

Prepare the PIPL and data export evidence file

Sorena AI helps turn the China Privacy Law PIPL entrusted processing and vendor contracts decision into owners, controls, and reviewer-ready records.

Research workflow

Map official sources to evidence

Research Copilot connects the official citation, decision, owner, retained evidence, and change history.

Explore next step

Talk to Sorena

Review the China route

Check the China Privacy Law scope decision and unresolved launch questions with Sorena.

Explore next step

Primary sources

References and citations

PRC Personal Information Protection Law

cac.gov.cn

Referenced sections

Articles 55-56 require a pre-processing impact assessment for entrustment, state its minimum subjects, and require the report and processing record to be retained for at least three years.

Related guides