QuestionChina

How should vendor contracts handle entrusted processing under PIPL? Direct answer

An Article 21 entrusted-processing contract must state the purpose, duration, method, personal-information categories, protective measures, and both parties' rights and obligations. The personal information processor must supervise the entrusted party.

First confirm that the vendor acts within the processor's agreed scope. A vendor that determines its own purpose or method may instead be another personal information processor or a joint processor.

Back to main artifact Review sources

Author

Sorena AI

Published

Jul 5, 2026

Updated

Jul 24, 2026

Questions

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Jul 5, 2026

Updated Jul 24, 2026

Overview

PIPL has applied since November 1, 2021. For under Article 21, the contract must state the purpose, duration, processing method, personal-information categories, protective measures, and both parties' rights and obligations. The personal information processor remains responsible for supervision. The entrusted party must follow the agreement, return or delete the information when the arrangement ends, and obtain the processor's consent before sub-entrusting another party.

Search this module

Find a question or answer quickly

2 of 2 questions

Question 1

Classify the relationship before drafting

Article 21 applies when the vendor processes personal information within the customer's agreed instructions and scope. If both parties decide the purpose and method, Article 20's joint-processing rule may apply. If the vendor receives the information and determines its own purpose or method, Article 23's provision-to-another-processor rule may apply, including recipient notice and separate consent.

The contract label does not decide the legal role. Record who decides the purpose, method, categories, retention, recipients, and onward use for each processing activity.

Entrusted party: process only within the agreed purpose, method, and other contractual limits.
Personal information processor: supervise the entrusted party's processing rather than treating the signed contract as the end of oversight.
Joint processors: agree their respective rights and obligations, while preserving the individual's ability to exercise PIPL rights against either processor.
Another processor receiving personal information: give the Article 23 recipient notice and obtain separate consent before provision, unless a different legal rule controls.

Citations

PRC Personal Information Protection Law

Articles 20-23 distinguish joint processing, entrusted processing, and provision to another personal information processor, with different agreement, supervision, notice, and consent consequences.

Question 2

Required terms and useful operational clauses

Put every Article 21 item in the binding agreement: purpose, duration, method, personal-information categories, protective measures, and both parties' rights and obligations. State that the entrusted party may not exceed the agreed purpose or method, must return or delete the information without retaining it when the contract is ineffective, invalid, revoked, or terminated, and may not sub-entrust without the processor's consent.

Article 59 separately requires the entrusted party to take necessary security measures and assist the personal information processor with its PIPL duties. Translate that obligation into activity-specific clauses. Incident notice timing, rights-request support, access controls, audit evidence, deletion verification, and overseas-access restrictions should match the service and risk; PIPL does not prescribe one universal clause set for every vendor.

Scope schedule: systems, purposes, duration, methods, information categories, people concerned, access locations, retention, and approved recipients.
Security and assistance: organizational and technical safeguards, incident escalation, rights-request support, compliance evidence, and named contacts.
Sub-entrustment: prior-consent process, required flow-down terms, current sub-entrusted parties, and responsibility for monitoring the chain.
Exit: return-or-deletion instructions, confirmation evidence, backup treatment, and the narrow legal basis for any retention that cannot end immediately.
Oversight file: due diligence, contract approval, supervision results, remediation, and the prior Article 55 PIPIA. PIPL requires the PIPIA report and record of the assessed processing to be kept for at least three years.

Citations

PRC Personal Information Protection Law

Articles 21 and 59 establish the mandatory entrusted-processing terms, supervision, return-or-deletion, sub-entrustment, security, and assistance duties. Articles 55-56 require a prior PIPIA for entrustment and at least three years' retention.

Operationalize the requirement

Prepare the PIPL and data export evidence file

Sorena AI helps turn the answer to "How should vendor contracts handle entrusted processing under PIPL?" into assigned controls and retained evidence.

Research workflow

Map official sources to evidence

Research Copilot connects the official citation, decision, owner, retained evidence, and change history.

Explore next step

Talk to Sorena

Review the China route

Check the China Privacy Law scope decision and unresolved launch questions with Sorena.

Explore next step

Primary sources

References and citations

PRC Personal Information Protection Law

cac.gov.cn

Referenced sections

Articles 21 and 59 establish the mandatory entrusted-processing terms, supervision, return-or-deletion, sub-entrustment, security, and assistance duties. Articles 55-56 require a prior PIPIA for entrustment and at least three years' retention.

Related guides