Search every question across sub-FAQs

Article 21 applies when the vendor processes personal information within the customer's agreed instructions and scope. If both parties decide the purpose and method, Article 20's joint-processing rule may apply. If the vendor receives the information and determines its own purpose or method, Article 23's provision-to-another-processor rule may apply, including recipient notice and separate consent.

The contract label does not decide the legal role. Record who decides the purpose, method, categories, retention, recipients, and onward use for each processing activity.

Put every Article 21 item in the binding agreement: purpose, duration, method, personal-information categories, protective measures, and both parties' rights and obligations. State that the entrusted party may not exceed the agreed purpose or method, must return or delete the information without retaining it when the contract is ineffective, invalid, revoked, or terminated, and may not sub-entrust without the processor's consent.

Article 59 separately requires the entrusted party to take necessary security measures and assist the personal information processor with its PIPL duties. Translate that obligation into activity-specific clauses. Incident notice timing, rights-request support, access controls, audit evidence, deletion verification, and overseas-access restrictions should match the service and risk; PIPL does not prescribe one universal clause set for every vendor.

Run the territorial tests independently. PIPL applies to processing in China and also to specified processing outside China involving people in China, including offering them products or services or analyzing or assessing their behavior. GDPR applies to processing in the context of an EU establishment and, for certain organizations outside the EU, to offering goods or services to people in the EU or monitoring their behavior there.

Map roles from the facts. PIPL defines a personal information processor by independent control over purpose and method and separately regulates joint processing, entrusted processing, and provision to another processor. GDPR uses controller, joint controller, and processor concepts. The labels often align operationally, but they are not interchangeable legal conclusions.

Both laws allow processing without consent in defined circumstances, but the lists and conditions differ. PIPL Article 13 includes consent, contract necessity, qualifying human-resources management, legal duties, emergencies, public-interest reporting or supervision, lawfully public information, and other statutory grounds. GDPR Article 6 uses consent, contract, legal obligation, vital interests, public task, and legitimate interests, subject to its conditions.

PIPL and GDPR both impose added conditions on higher-risk processing, but the tests differ. PIPL permits sensitive personal information only for a specific purpose, with sufficient necessity and strict safeguards, and generally requires separate consent plus a prior PIPIA. GDPR Article 9 generally prohibits special-category processing unless an Article 9 exception applies; its categories and exceptions do not match PIPL's.

The assessment triggers also differ. PIPL Article 55 expressly includes sensitive personal information, automated decision-making, entrusted processing, provision to another processor, public disclosure, overseas provision, and other processing with a major effect on rights and interests. GDPR Article 35 requires a DPIA where processing is likely to result in a high risk and gives specific examples. Reuse the system and risk facts, but test both thresholds and required content.

Do not interchange transfer tools. PIPL Article 38 uses a CAC security assessment, certification, the CAC standard contract, or another recognized condition, with additional notice, separate-consent, and PIPIA duties for personal-information exports. GDPR Chapter V uses its own adequacy decisions, appropriate safeguards such as EU standard contractual clauses, and limited derogations.

Both laws provide access, correction, deletion, objection or refusal, and automated-decision protections, but their conditions and procedures are not identical. PIPL gives individuals rights to know and decide, restrict or refuse processing, access and copy, correct, and delete under stated conditions. GDPR provides its own access, rectification, erasure, restriction, portability, objection, and automated-decision rights, each with separate conditions and exceptions.

Incident rules also require separate clocks. Under PIPL Article 57, a processor must immediately take remedial measures and notify the responsible authorities and individuals when personal information is or may be leaked, altered, or lost; individual notice can be omitted if effective measures avoid harm, although an authority may still require it. Under GDPR Articles 33-34, a controller generally notifies the supervisory authority within 72 hours after becoming aware of a breach unless it is unlikely to risk people's rights and freedoms, and notifies affected people without undue delay when the breach is likely to create a high risk.

Article 28's examples are representative categories, not a complete field dictionary. Classify the actual information and processing context by asking whether leakage or illegal use could readily cause either kind of statutory harm. A field that looks ordinary in isolation may become sensitive when combined with other data or used to infer health, identity, movements, finances, or another protected condition.

The category includes all personal information of a child under 14, even if the same field would not be sensitive for an adult. For example, a child's basic account identifier falls within the child-specific rule because of the person's age.

A processor may handle sensitive personal information only for a specific purpose, with sufficient necessity and strict protective measures. Before processing, give the general Article 17 notice plus the necessity of the sensitive processing and its effect on the individual's rights and interests, unless a PIPL notice exception applies.

Where consent is required, obtain separate consent. Article 13 says consent is not required when one of its listed non-consent circumstances applies, so record that conclusion instead of collecting consent by default. If a law or administrative regulation requires written consent for the particular processing, follow that rule. For a child under 14, obtain consent from a parent or other guardian and adopt dedicated personal-information processing rules. Complete a PIPIA before the processing and retain its report and processing record for at least three years.

The provisions listed below call for separate consent when consent is required. It is different from a general acceptance of a privacy notice and must relate to the specified activity. Article 13 says consent is not required when one of its listed non-consent circumstances applies, so document the exact Article 13 conclusion before designing the consent flow. The processor must still satisfy the applicable notice, necessity, security, and impact-assessment duties.

Where processing relies on consent, Article 14 requires a voluntary and explicit choice made with sufficient knowledge. If the purpose, processing method, or categories of personal information change, obtain consent again. Article 15 also requires a convenient way to withdraw consent. A contract necessity or other Article 13 circumstance should be assessed on its own conditions; it is not created by a separate-consent screen.

PIPL does not mandate a checkbox, modal, signature, or other specific interface. Use a design that makes the specified activity clear and captures an affirmative choice separate from unrelated permissions. Do not describe a bundled acceptance of terms as separate consent merely because the notice mentions the activity.

Keep enough evidence to reconstruct what the person saw and did. This is an operational record, not an official form prescribed by PIPL.

Complete a PIPIA before processing sensitive personal information; using personal information for automated decision-making; entrusting processing; providing personal information to another processor; publicly disclosing it; providing it outside China; or carrying out another activity with a major effect on personal rights and interests.

Identify the system, business owner, processor role, people concerned, purpose, Article 13 basis, collection source, information categories, processing methods, recipients, locations, retention, deletion, rights handling, and security controls. The assessment should describe the intended operation, not only repeat a privacy notice or contract.

Article 56 requires three conclusions: whether the purpose and method are lawful, legitimate, and necessary; the effect on personal rights and interests and the security risks; and whether the safeguards are lawful, effective, and proportionate to the risk. Show the facts, evidence, and reasoning behind each conclusion.

PIPL requires retention of the assessment report and processing record. It does not prescribe a universal template, risk matrix, named approver, mandatory report length, or retention rule for every supporting input. Use the organization's governance process, but label internal scoring, evidence attachments, sign-off fields, and any longer retention period as organizational controls rather than Article 56 requirements.

Start with what the user is obtaining, not the app's marketing label. Match that basic function to the 2021 category and map each proposed field to the listed scope. If the app provides several distinct basic functions, document the category and necessary scope for each function rather than treating the broadest category as permission for the whole product.

The list sets the outer scope of information treated as necessary for each stated basic function. It does not require collection of every listed item when the app can deliver the function without it. It also does not make optional analytics, advertising, personalization, contacts, background permissions, or SDK events necessary merely because they support the business.

For every field, device permission, SDK, and event, record the product function, collection timing, recipient, purpose, and whether the item is necessary for the basic function. If it is outside the category scope or the function works without it, keep it out of the mandatory flow and do not block the basic function when the user refuses.

Then apply PIPL. Identify the processing basis, give the required notice, keep collection within the minimum necessary range, use the shortest necessary retention, and address sensitive personal information, children under 14, security, individual rights, and PIPIA triggers.

First decide whether the activity provides data outside China and whether that data contains personal information or important data. Then apply the 2024 exemptions. Next determine whether the exporter is a critical information infrastructure operator (CIIO), whether important data is involved, and how many individuals' non-sensitive and sensitive personal information has been exported since January 1.

A CIIO exporting personal information or important data must use the security-assessment route. A non-CIIO must also use that route for important data, personal information of at least 1 million individuals excluding sensitive personal information, or sensitive personal information of at least 10,000 individuals. For a non-CIIO, Article 8 places exports from 100,000 to under 1 million individuals excluding sensitive personal information, and exports involving any sensitive personal information below 10,000 individuals, in the standard-contract-or-certification band unless an exemption controls.

Complete the export PIPIA before the transfer. It should examine the legality, legitimacy, and necessity of both parties' processing; the exported information's scale, scope, categories, and sensitivity; risks to individuals; the overseas recipient's commitments, measures, and capability; the availability of rights channels; and the effect of the recipient country's or region's law on performance.

Use the CAC contract in the form attached to the measures. Additional terms are allowed only if they do not conflict with it. The contract must take effect before the export begins. File the effective contract and PIPIA report with the provincial CAC within 10 working days after effectiveness; filing is not described as an approval of the export.

Start with the actual outbound flow, exporter, data, recipients, and count period. Determine CIIO status through the applicable designation process. For important data, check relevant sector or regional catalogues, published identification, and authority notices. The 2024 provisions say data need not be submitted as important data when a relevant department or region has neither notified the processor nor publicly identified it as important.

Count personal information exported from January 1 of the current year. Count personal information excluding sensitive personal information against the 1 million threshold and count sensitive personal information separately against the 10,000 threshold.

Before applying, test the 2024 exemptions for data without personal information or important data in specified cross-border activities; qualifying overseas-origin personal information returned abroad without domestic personal information or important data added; necessary performance of an individual's contract; qualifying cross-border HR management; emergencies protecting life, health, or property; low-volume non-sensitive exports by a non-CIIO; and an applicable pilot free-trade-zone negative list. Each exemption has conditions, and the personal-information exemptions do not cover important data.

When an assessment is triggered, complete the export risk self-assessment and apply through the provincial CAC. The application materials include the application, self-assessment report, the legal document with the overseas recipient, and other materials required for the assessment.