Processes personal data, in China

Cybersecurity Law of the People's Republic of China (as amended by the Decision of October 28, 2025), Art. 23 · Read the law's page

• This binds a network operator, meaning any organization that owns or manages a network or provides services over one, so it reaches every declared activity and every declared role; the level of protection follows the classification of the network under the classified protection system.
• Formulate internal security management rules and operating procedures, designate a person responsible for network security and put network security protection responsibility into effect (Article 23, item 1).
• Take technical measures against computer viruses, network attacks and network intrusions (Article 23, item 2).
• Monitor and record the network's operating status and security incidents and keep the network logs for not less than six months (Article 23, item 3).
• Take data classification, backup of important data and encryption measures (Article 23, item 4).

Arts. 8 and 13, Provisions on the Management of Network Product Security Vulnerabilities (Ministry of Industry and Information Technology, Cyberspace Administration of China and Ministry of Public Security) · Read the law's page

• Applies to a network operator, meaning the owner or manager of a network or a provider of services over one, so it reaches an app developer that runs its own servers or service (Articles 2 and 8).
• On finding or learning that your network, information system or equipment has a security vulnerability, take measures at once, verify the vulnerability in good time and complete its repair (Article 8).
• Keep a channel for receiving vulnerability information open and unobstructed, and keep the receipt logs for at least 6 months (Article 5).

Data Security Law of the People's Republic of China, Art. 27 · Read the law's page

• This binds any organization or individual engaging in a data-processing activity, regardless of sector, and reaches data generally rather than only personal information.
• Establish and maintain a full-process data-security management system covering the collection, storage, use, processing, transmission, provision, and disclosure of the data you process, and provide data-security education and training to your staff.
• Take the technical measures and other necessary measures appropriate to your processing to keep your data secure.
• Where you process data over the internet or another information network, meet this duty in addition to, not instead of, your classified-protection obligations under the Cybersecurity Law, already this jurisdiction's own deferred network-operator duty.
• If you process important data, an official classification this corpus cannot flag against on its own, designate a person responsible for data security and a managing body, and implement that responsibility.

Data Security Law of the People's Republic of China, Art. 29 · Read the law's page

• Strengthen risk monitoring of your data-processing activity, and on discovering a data-security defect, vulnerability, or other risk, immediately take remedial measures.
• On an actual data-security incident, immediately take disposal measures, promptly notify affected users as provided, and report the incident to the competent authority; the statute states no numeric deadline, only immediacy and promptness.
• This binds the same data processor as this jurisdiction's Data Security Law data-security-program duty; it adds a risk-monitoring and incident-response duty rather than reaching a different party.
• A processor of important data carries an additional, periodic risk-assessment-and-reporting duty under Article 30 tied to the important-data classification rather than to any activity in this vocabulary, so it is not flagged as its own instrument.

PIPL Art. 54; CAC Order No. 18 (Measures for the Administration of Personal Information Protection Compliance Audits), Arts. 3-4, 6, 12 · Read the law's page

• Audit, at regular intervals, whether your processing of personal information complies with laws and administrative regulations (PIPL Article 54), through your own internal body or a specialized institution you commission (Measures Article 3).
• If you process the personal information of more than 10 million people, conduct a personal information protection compliance audit at least once every two years (Measures Article 4).
• If you process the personal information of 1 million or more people, designate a person in charge of personal information protection who is responsible for your compliance audit work (Measures Article 12).
• If you provide an important internet platform service, with a very large number of users and complex types of business, set up an independent body made up mainly of external members to oversee your compliance audits (Measures Article 12).
• Refer to the Personal Information Protection Compliance Audit Guidelines annexed to the Measures when you audit (Measures Article 6).

PIPL Art. 57 · Read the law's page

• Upon discovering an actual or possible leak, alteration, or loss of personal information, immediately take remedial measures and notify both the department performing personal information protection duties and the affected individuals; you may omit notice to the individuals where your measures can effectively prevent harm from the leak, alteration or loss, unless that department believes harm may result and requires you to notify them.
• Include in any breach notice the categories of information involved, the cause, possible harm, remedial steps taken, what affected individuals can do to protect themselves, and the handler's contact information.

PIPL Arts. 1-23, 33-37; adopted by the Standing Committee of the 13th National People's Congress, 20 August 2021; effective 1 November 2021 · Read the law's page

• Establish one of PIPL's enumerated lawful bases, most commonly informed consent, before collecting or processing personal information of a person in China.
• Limit personal information processing to the minimum scope and duration necessary for a stated, specific purpose.
• Where personal information is entrusted to a third party processor, execute a written entrustment agreement and supervise that processor's handling; the processor may not exceed the agreed purpose or method and must return or delete the data when the entrustment ends.
• Where two or more processors jointly decide a shared processing purpose and method, agree in writing on each party's respective duties; the individual may still exercise rights against any one of them, and the processors bear joint and several liability for resulting harm.
• Apply the same processing duties to a government agency's processing of personal information as to private processing.

PIPL Arts. 28-32 · Read the law's page

• Obtain the individual's separate, explicit consent before processing any sensitive personal information, including a biometric identifier such as a faceprint or voiceprint, in addition to any general consent already collected.
• Notify the individual of the necessity of the processing and its impact on their rights before collecting sensitive personal information.
• Process biometric identifiers only for a specific, necessary purpose and under strict protective measures, and obtain guardian consent before processing a minor's data.
• No dedicated voiceprint statute exists as of this date; voiceprint is covered under this same sensitive-category duty rather than a separate biometric-specific rule.

PIPL Arts. 38-40 · Read the law's page

• Complete a CAC security assessment, personal-information-protection certification, or CAC standard contract before transferring personal information out of China, unless a specific exemption applies.
• Give advance notice disclosing the overseas recipient's identity and contact details, and obtain the individual's separate consent, before transferring their personal information abroad.
• Store personal information collected within China domestically if operating as a critical information infrastructure operator or processing above the state-set volume threshold; export only after a security assessment.

PIPL Arts. 4, 51 and 73 · Read the law's page

• Treat information as outside the definition of personal information on the strength of anonymization only if the processing leaves a specific natural person unidentifiable and cannot be reversed (Article 4 and Article 73, item 4).
• Do not treat de-identification as anonymization: information processed so that it cannot identify a specific natural person without additional information is de-identified (Article 73, item 3), and the exclusion in Article 4 is written for anonymized information alone.
• Take the technical security measures Article 51, item 3 names, encryption, de-identification and similar measures, in the form that fits the purpose and method of the processing, the type of personal information, the impact on individuals' rights and interests and the security risks, so as to prevent unauthorized access and the leakage, tampering and loss of personal information (Article 51).

PIPL Arts. 44-50 · Read the law's page

• Provide a convenient channel for individuals to access, copy, correct, or delete their personal information, and to request portability to another handler where state conditions are met.
• Give a reasoned written explanation whenever a rights request is refused.

PIPL Arts. 60-71 · Read the law's page

• Comply with lawful CAC and sectoral-regulator investigation, including document production and on-site inspection.
• Bear the burden of proving the absence of fault once an individual establishes harm from unlawful personal information processing, or pay compensation.

促进和规范数据跨境流动规定, issued by the Cyberspace Administration of China, effective 22 March 2024 · Read the law's page

• Confirm which volume tier applies before exporting personal information from China: under 100,000 individuals' non-sensitive personal information a year (or a listed necessary-business exemption) needs no mechanism, 100,000 to under 1,000,000 needs a standard contract or certification, and 1,000,000 or more, or sensitive personal information export above 10,000 individuals, needs the full CAC security assessment.
• Complete a security assessment before any cross-border personal information export if operating as a critical information infrastructure operator, regardless of volume.

Regulation on Network Data Security Management (State Council Order 790), Arts. 9-11 · Read the law's page

• Applies to a network data processor, meaning an individual or organization that decides for itself the purpose and means of processing network data, for processing in China (Articles 2 and 62); because that reaches almost any organization running a system, this instrument flags on every activity and role this corpus can express.
• Protect network data on the basis of classified cybersecurity protection: keep data security management rules in place and use encryption, backup, access control and security authentication (Article 9).
• On finding a security defect, vulnerability or similar risk in a network product or service you provide, take remedial measures at once, tell users as required and report to the competent department; where national security or the public interest is endangered, also report to the competent department within 24 hours (Article 10).
• Keep an emergency plan for network data security incidents; when an incident occurs, start the plan at once, act to stop the harm spreading and remove the hazard, and report to the competent department as provided (Article 11).
• Where an incident harms the lawful rights and interests of individuals or organizations, promptly tell those affected the incident, the risk, the harm and the remedial steps taken, by phone, text message, instant message, email or public announcement, unless a law or administrative regulation allows non-notification (Article 11).

人脸识别技术应用安全管理办法, issued jointly by the Cyberspace Administration of China and the Ministry of Public Security, signed 13 March 2025, effective 1 June 2025 · Read the law's page

• These duties bind the deployment and use of facial recognition; Article 2 exempts facial-recognition R&D and algorithm-training activities from the Measures. Obtain separate, explicit, informed, voluntary consent before collecting or using facial recognition data, with guardian consent for anyone under 14, and use the method with the least impact on individual rights available.
• Store captured facial information only on the recognition device itself; do not transmit it over the internet unless a legal exception applies or the individual has separately consented.
• Retain facial information no longer than the minimum time necessary for the stated purpose.
• Offer a non-facial-recognition verification alternative whenever one exists; do not make facial recognition the sole means of identity verification.
• Do not install facial recognition devices inside hotel rooms, public bathhouses, public changing rooms, or public restrooms.
• File with the provincial-level cyberspace administration once the stored facial-information count reaches 100,000 individuals.

Measures for the Administration of National Cybersecurity Incident Reporting (Cyberspace Administration of China, issued September 11, 2025), Arts. 2, 4, 5, 8, 9, 12, 14 · Read the law's page

• On discovering or becoming aware of a cybersecurity incident affecting your own operations, grade it against China's four-tier National Cybersecurity Incident Classification and Grading Guide (especially major, major, relatively major, ordinary), and report only where you grade it relatively major or above; an ordinary incident carries no report duty under this instrument.
• Where the incident involves critical information infrastructure, report to your sector's protection-work department and to the public security organ within 1 hour of discovering or becoming aware of the incident.
• Where you are a department of a central or state organ, or a directly affiliated unit of one, report to your own department's cyberspace affairs unit within 2 hours of discovering or becoming aware of the incident.for a public body
• Every other network operator must report to the cyberspace administration department of its own province within 4 hours of discovering or becoming aware of the incident.
• Where your industry carries its own reporting rule, also report as your industry's regulator requires, and report a suspected crime to the public security organ promptly.
• Where an organization or individual provides you network-security or system-operation-and-maintenance services under contract, require that provider by contract to promptly report to you any cybersecurity incident it discovers through monitoring, and to assist your own reporting under these Measures; this is the paragraph that reaches a cloud host, managed-security vendor, or AI operator serving you as its customer.
• Within 30 days of completing disposal of a relatively major incident or above, submit a summary report covering the incident's cause, your emergency response, the harm caused, accountability, remediation, and lessons learned, through the same channel you used for the original report.
• This binds a network operator, meaning the owner, manager, or network service provider of a network, that builds or operates a network, or provides a service through a network, inside China; because that reaches almost any organization running a system, this instrument flags on every activity and role this corpus can express rather than a narrower guess.
• A major or especially major incident additionally triggers an escalation between government bodies up to the national cyberspace administration after you report; that further escalation is not a step you perform yourself.
• Taking reasonable and necessary protective measures, disposing of the incident under your emergency plan, effectively reducing its impact and harm, and reporting it promptly as these Measures require can draw lighter treatment, or none at all, of the liability of your unit and its personnel for the incident.