Personal Information Protection Law, Sensitive Personal Information

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 November 2021.

A sensitive categories rule binding public and private bodies.

As of 23 August 2026.

What it requires

Obtain the individual's separate, explicit consent before processing any sensitive personal information, including a biometric identifier such as a faceprint or voiceprint, in addition to any general consent already collected.
Notify the individual of the necessity of the processing and its impact on their rights before collecting sensitive personal information.
Process biometric identifiers only for a specific, necessary purpose and under strict protective measures, and obtain guardian consent before processing a minor's data.
No dedicated voiceprint statute exists as of this date; voiceprint is covered under this same sensitive-category duty rather than a separate biometric-specific rule.

What it reaches

Excludes recording-derived identifiersNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 28 defines sensitive personal information as information whose leak or misuse would easily harm dignity or personal or property safety, expressly including biometric identification information (covering both faceprint and voiceprint as instances of the same category) alongside religious belief, specific identity, medical health, financial accounts, and location tracking, and extends automatically to a minor's information under 14.

Article 29 requires separate, explicit consent before processing any sensitive personal information, layered on top of the general lawful-basis requirement, Article 30 requires advance notice of necessity and impact, and Article 31 requires guardian consent for a minor's data. The biometric definition carries no exclusion for an identifier extracted from an existing photo, video, or audio recording.

When LexLint raises it

processes_biometrics
processes_voice
high_risk_decisions

Read the law

official CAC-published full Chinese statutory text

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app