Checklist for PIPL privacy notices, valid consent, separate consent, sensitive information, children under 14, withdrawal, and rights requests.
Give the Article 17 notice before processing, then match each consent request to the specific activity. Consent is not required under PIPL when another Article 13 condition is the documented basis.
Structured answer sets in this page tree.
Cited legal and guidance references.
Give a prominent, clear, accurate, and complete before processing. If consent is the Article 13 basis, the person must act voluntarily and explicitly after being fully informed. Where consent is the processing condition, is an additional, activity-specific consent for the PIPL situations that expressly require it; a general privacy-policy acceptance should not be treated as proof of every separate-consent decision.
Name the personal information processor and give its contact details. For each purpose, state the processing method, personal-information categories, retention period, and the method and procedure for exercising PIPL rights. Make the rules public and easy to consult and save.
A general notice is not enough for every special activity. Add the recipient's identity, contact details, purpose, method, and data categories before providing personal information to another independent processor. For an overseas recipient, also explain how the person can exercise PIPL rights against that recipient. For sensitive personal information, explain why processing is necessary and how it may affect the person's rights.
Article 13 recognizes consent and several non-consent processing conditions. Record the condition used for each purpose. When consent is used, make withdrawal as convenient as giving consent, and do not refuse the product or service after refusal or withdrawal unless the disputed processing is necessary to provide it.
When consent is the processing condition, obtain before providing personal information to another personal information processor, publicly disclosing it, processing sensitive personal information, or providing it overseas. Public-place image or identification information may be used only for public security unless separate consent supports another use. If another law or administrative regulation requires written consent, separate consent alone does not replace that form requirement.
Review each screen and processing event against the data map, not only the published policy. A notice can be accurate while the product collects a different field, sends data to an undisclosed recipient, keeps it longer, or fails to apply withdrawal.
Complete a personal information protection impact assessment before processing sensitive information, entrusting processing, providing information to another processor, publicly disclosing information, or exporting information. Keep the PIPIA report and processing record for at least three years.
Assign owners, implement controls, and keep the notice, consent, withdrawal, and rights evidence together.
Research Copilot connects the official citation, decision, owner, retained evidence, and change history.
Check the China Privacy Law scope decision and unresolved launch questions with Sorena.