What counts as sensitive personal information in China? Direct answer

Article 28's examples are representative categories, not a complete field dictionary. Classify the actual information and processing context by asking whether leakage or illegal use could readily cause either kind of statutory harm. A field that looks ordinary in isolation may become sensitive when combined with other data or used to infer health, identity, movements, finances, or another protected condition.

The category includes all personal information of a child under 14, even if the same field would not be sensitive for an adult. For example, a child's basic account identifier falls within the child-specific rule because of the person's age.

A processor may handle sensitive personal information only for a specific purpose, with sufficient necessity and strict protective measures. Before processing, give the general Article 17 notice plus the necessity of the sensitive processing and its effect on the individual's rights and interests, unless a PIPL notice exception applies.

Where consent is required, obtain separate consent. Article 13 says consent is not required when one of its listed non-consent circumstances applies, so record that conclusion instead of collecting consent by default. If a law or administrative regulation requires written consent for the particular processing, follow that rule. For a child under 14, obtain consent from a parent or other guardian where consent is required, and adopt dedicated personal-information processing rules. Complete a PIPIA before the processing and retain its report and processing record for at least three years.