How should vendor contracts handle entrusted processing under PIPL? Direct answer

Article 21 applies when the vendor processes personal information within the customer's agreed instructions and scope. If both parties decide the purpose and method, Article 20's joint-processing rule may apply. If the vendor receives the information and determines its own purpose or method, Article 23's provision-to-another-processor rule may apply, including recipient notice and, where processing relies on consent, separate consent.

The contract label does not decide the legal role. Record who decides the purpose, method, categories, retention, recipients, and onward use for each processing activity.

Put every Article 21 item in the binding agreement: purpose, duration, method, personal-information categories, protective measures, and both parties' rights and obligations. State that the entrusted party may not exceed the agreed purpose or method, must return or delete the information without retaining it when the contract is ineffective, invalid, revoked, or terminated, and may not sub-entrust without the processor's consent.

Article 59 separately requires the entrusted party to take necessary security measures and assist the personal information processor with its PIPL duties. Translate that obligation into activity-specific clauses. Incident notice timing, rights-request support, access controls, audit evidence, deletion verification, and overseas-access restrictions should match the service and risk; PIPL does not prescribe one universal clause set for every vendor.