The general compliance obligations applicable to processing of personal information under the PIPL apply to the online (and offline) environments. In addition, the PIPL imposes additional compliance obligations on organisations that fall into one of the following categories:

• "Important internet platform providers";
• Data controllers processing data of a "large volume of users"; or
• "Complex businesses".

It is still unclear which organisations would fall within these categories, but these organisations must comply with additional measures when processing personal information, namely:

1. Set up personal information protection compliance mechanisms;
2. Set up external independent data protection organisations to supervise data protection mechanisms;
3. Establish platform regulations;
4. Establish and publish processing obligations and processing rules that regulate products and service providers in an open and fair manner;
5. Stop the provision of products or service providers if they violate the law or regulations as regards processing of personal information; and
6. Publish from time to time social responsibility reports as regards processing of personal information.

In terms of automated–decision making and profiling:

• Analytics or evaluation based on computer programme around behavior, interests, hobbies, credit information, health or decision making activities, must be transparent, open and fair, and should not apply any differential treatment between individuals; and
• Any push information or business marketing should not be directed to an individual's character and should provide individuals with a convenient way to opt out.

The Network Data Regulation sheds further light on the data protection obligations of “large scale” personal information handlers and online platform operators.

 “Large Scale” Personal Information Handlers 

The Network Data Regulation requires a network data handler who processes personal information of more than 10 million data subjects to:

• appoint a network data security officer (who shall be a member of senior management) and establish a network data security management department; and 
• if the security of network data may be affected by a network data handler’s M&A, corporate reorganization, dissolution, bankruptcy or other similar events, the handler must take measures to ensure data security, and report information regarding the data recipients and related matters to the relevant industry regulator and / or data authority at provincial level or above.

Online Platform Operators

The Network Data Regulation emphasizes existing obligations on online platform operators (that is, operators of websites, mobile apps, etc.) to monitor and supervise data processing activities carried out by the users or third parties via their platforms. For example:

• platform operators must formulate rules and put in place effective contracts with third parties residing on the platform to clarify data protection obligations and responsibilities; and
• app store operators must conduct security assessments of the applications distributed via their stores, and remove non-compliant applications if the compliance gaps cannot be effectively remediated.

Notably, the Network Data Regulation now extends the definition of online platform operators to manufacturers of smart terminal devices with pre-installed applications (such as mobile phone and smart home product manufacturers), and requires them to comply with online platform operators’ obligations in addition to hardware manufacturers’ obligations.

The Network Data Regulation also introduces a definition of “large scale network platforms” as online platforms which have more than 50 million registered users or more than 10 million monthly active users, offer complex types of services, and may have significant impact on national security, economy and people’s livelihood. The Regulation further provides that large scale network platform operators are subject to additional obligations such as publishing an annual social responsibility report discussing how personal information protection matters are handled, and implementing measures to prevent unfair competition conducted via the platforms, etc.

Apart from the PIPL and the Network Data Regulation, the CSL, Consumer Protection Law and E–Commerce Law offer protection to consumer / user personal information. As well as personal information protection, under these rules data controllers should strengthen management of information provided by users, prohibit the transmission of unlawful information and take necessary measures to remove any infringing content, then report to supervisory authorities. Sufficient notice and adequate consent should be obtained from data subjects prior to the collection and use of personal information. Further obligations are imposed on mobile apps providers including but not limited to conducting real–name identification, undertaking information content review.

In recent years, the regulators have also issued a range of guidelines targeting mobile app providers. These guidelines introduce specific data protection and privacy obligations aiming to regulate the data collection practices and processing activities of mobile app providers. There has also been a crackdown against (suspected) non–compliant mobile apps. Organisations are advised to review their app compliance as a matter of priority.

Data subject rights (under the PIPL and other laws within the personal information framework), include rights to access and obtain information about their data held and processed, to correct their data, to request deletion of data in the event of a data breach, to object to automated decision–making, to transfer their data to third party data controller and to de–register their account etc. Most importantly is the right to withdraw consent to personal information processing. The draft National Standard of Data security technology — Requirements for Personal Information Transfer Based on Request of Personal Information Subject, published for public consultation on April 4, 2024, sets out comprehensive requirements and procedures for data controllers to respond to data portability requests from data subjects. The Network Data Regulation also sets out the conditions to be met for data subjects to exercise data portability rights with network data handlers.

There are currently no specific requirements regarding cookies within existing laws or regulations in the PRC. However, the use of cookies and / or similar tracking technologies, to the extent they constitute processing of personal information, should be notified to data subjects as part of a privacy policy and adequate consent should be obtained from data subjects for such use.