Notice

A data controller must provide data subjects with a privacy notice, including at least the following information:

• the name and contact information of the data controller;
• the categories of personal information processed;
• where sensitive personal information is processed, the specific categories of sensitive personal information must be highlighted and the data subjects must be informed of how the processing may affect their rights and interests;
• the processing purposes;
• the types of data processors engaged by the data controller;
• the following details about each separate data controller and each overseas recipient: name, contact information, categories of personal information shared and the processing purposes;
• measures implemented to protect personal information, storage location and retention period;
• rights of the data subjects, and mechanisms via which data subjects may exercise their rights; and
• other details as required by the PIPL. 

There are additional notice and transparency requirements applicable to the processing conducted in mobile applications.

The information in the privacy notice must be true, accurate and complete. The contents of the privacy notice must be clear and easy to understand. The privacy notice should be made available to the data subjects before the processing occurs. Data subjects should be notified of changes to a privacy notice and (depending on the extent of changes made) further consent may need to be obtained.

Consent and other lawful bases

The primary lawful basis for processing personal information is explicit, opt-in consent. 
There are alternative lawful bases available under the PIPL, including:

• the processing is necessary for entering into or fulfilling a contract where the data subject is a named party;
• the processing is necessary for carrying out human resources management under an employment policy legally established or a collective contract legally concluded;
• the processing is necessary for fulfilling legal obligations;
• the processing is necessary for protecting the interests of natural person during any public health emergency or otherwise responding to a public health emergency, or in an emergency to protect the safety of natural persons’ health and property;
• the processing is necessary for carrying out news reporting and public opinion monitoring for public interests;
• the personal information being processed is already made public legally and the processing is within the reasonable scope and in accordance with the requirements of the PIPL; and
• the processing is to comply with another PRC law.

However, in practice, it is unclear how the "necessity" element in these alternative lawful bases should be assessed. Thus, consent remains the primary lawful basis, and it is anticipated this will continue in practice.
Where a data controller relies on consent as the lawful basis, it must obtain: 

1. the express and informed consent from the data subject before personal information can be collected, used, transferred or otherwise processed. Implied consent is invalid; and 
2. the separate consent of the data subject (e.g. by using separate consent tick boxes) before conducting certain processing activities, namely: 

• • processing sensitive personal information;
  • overseas transfers of personal information;
  • public disclosure of personal information;
  • providing personal information to a separate data controller for processing; and
  • use of image or identification data collected in public through image or identification device for purposes other than maintaining public security.

Processing

Collection and processing of personal information must be directly related to the purpose of processing specified in the privacy notice. Excessive data collection must be avoided.

Appropriate technical (e.g. encryption and de-identification) and organizational (e.g. access control) measures must be implemented to protect the security and confidentiality of personal information.

Before personal information is provided to any third party, the data controller must assess the role of the third party (a controller or a processor), and sign an appropriate data processing agreement with the third party.

Personal information must be deleted or anonymized after the processing purposes are achieved or cannot be achieved, unless a longer retention period is permitted or required by law.

Impact assessment and record-keeping

The PIPL requires data controllers to undertake personal information protection impact assessments (PIPIA), and to retain the results and processing records (for at least three years), in the following circumstances:

• processing of sensitive personal information;
• using personal information to conduct automated decision-making;
• appointing a data processor;
• providing personal information to any third party (likely to include sharing with group companies);
• public disclosure of personal information;
• overseas transfer of personal information; and
• any other processing activities that may have "significant impact to an individual".

Details on the requirements for undertaking a PIPIA are set out in the National Standard of Information Security Technology – Guidelines on Personal Information Security Impact Assessment (effective from June 1 2021).

Compliance audit

A data controller processing personal information of more than 10 million data subjects must conduct a self-initiated compliance audit of its processing activities at least once every two years. Data controllers below this volume threshold should still conduct self-initiated audits on a regular basis, although the frequency is not prescribed by law. It is not mandatory to submit the reports of such self-initiated audits to the CAC.

The CAC may instruct any data controller to engage a qualified third party to conduct an audit, if the processing activities are found to involve significant risks or infringe upon the rights and interests of a large number of individuals, or if significant data incidents have occurred. The reports of such CAC-ordered audits will be reviewed by the CAC.

The Measures for the Administration of Personal Information Protection Compliance Audits (effective from 1 May, 2025) set out more than one hundred audit points that data controllers should refer to when carrying out compliance audits.