ChinaPersonal Information Protection Law, Sensitive Personal Information
In force since .
A sensitive categories rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Obtain the individual's separate, explicit consent before processing any sensitive personal information, including a biometric identifier such as a faceprint or voiceprint, in addition to any general consent already collected.NIST Privacy FrameworkCT.PO-P1
- Notify the individual of the necessity of the processing and its impact on their rights before collecting sensitive personal information.NIST Privacy FrameworkCM.AW-P1
- Process biometric identifiers only for a specific, necessary purpose and under strict protective measures, and obtain guardian consent before processing a minor's data.NIST Privacy FrameworkCT.PO-P1
- No dedicated voiceprint statute exists as of this date; voiceprint is covered under this same sensitive-category duty rather than a separate biometric-specific rule.
These lines are LexLint's reading of the law's text. Also read by: Cyberspace Administration of China (国家互联网信息办公室), the national cyberspace department that coordinates personal information protection and supervision under the Personal Information Protection Law (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.cac.gov.cn/2026-01/09/c_1769688003183197.htm
- Guidance body
- Cyberspace Administration of China (国家互联网信息办公室), the national cyberspace department that coordinates personal information protection and supervision under the Personal Information Protection Law
- Open questions
- Which laws and administrative regulations impose the 相关行政许可或者作出其他限制 ("related administrative licensing or other restrictions") that Article 32 defers to for a given category of sensitive personal information?
What it makes you log
Logging duty
Articles 28 to 32 define sensitive personal information, require a specific purpose, strict protective measures, separate consent, a notice of necessity and impact, parental consent for a child under 14 and special processing rules for such information. None of them requires a log, register or record. The impact assessment for sensitive processing and its three-year record are required by Articles 55 and 56, held on a separate row.
- Kind
- None
- As of
What this law does
Article 28 defines sensitive personal information as information whose leak or misuse would easily harm dignity or personal or property safety, expressly including biometric identification information (covering both faceprint and voiceprint as instances of the same category) alongside religious belief, specific identity, medical health, financial accounts, and location tracking, and extends automatically to a minor's information under 14.
Article 29 requires separate, explicit consent before processing any sensitive personal information, layered on top of the general lawful-basis requirement, Article 30 requires advance notice of necessity and impact, and Article 31 requires guardian consent for a minor's data. The biometric definition carries no exclusion for an identifier extracted from an existing photo, video, or audio recording.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .