Audit modelCompliance Checklist for China’s Personal Information Protection Law (PIPL)

Note: “personal information” under the PIPL refers to any kind of information related to an identified or identifiable natural person as electronically or otherwise recorded, excluding information that has been anonymized. Note: “processing” includes activities such as collection, storage, use, processing, transmission, provision, disclosure, and deletion of personal information.

1. where the purpose of the activity is to provide a product or service to individuals within China; or

2. where the purpose of the activity is to analyze or assess the behavior of individuals within China.

1. having obtained the consent from the individual;

2. it is necessary for the conclusion or performance of a contract to which the individual is a contracting party, or it is necessary for carrying out human resources management under an employment policy legally established or a collective contract legally concluded;

3. it is necessary for performing a statutory responsibility or statutory obligation;

4. it is necessary for responding to a public health emergency, or for protecting the life, health or property safety of a natural person in the case of an emergency;

5. the personal information is processed within a reasonable scope to carry out any news reporting, supervision by public opinions or any other activity for public interest purposes;

6. process the personal information, which has already been disclosed by the individual or otherwise legally disclosed, within a reasonable scope.

Note: “Automated decision-making” refers to the use of computer programs to automatically analyze or assess individual behaviors and habits, interests and hobbies, or situations relating to finance, health, or credit status, etc., and engage in decision-making activities.

Note: “sensitive personal information” means personal information that, once leaked or illegally used, may easily cause harm to the dignity of natural persons grave harm to personal or property security, including information on biometric characteristics, religious beliefs, speciallydesignated status, medical health, financial accounts, individual location tracking, etc., as well as the personal information of minors under the age of 14.

Note: “Personal information handler” refers to organizations and individuals that, in personal information processing activities, autonomously determine processing purposes.

Note: “Personal information handler” refers to organizations and individuals that, in personal information processing activities, autonomously determine processing purposes.

1. processing sensitive personal information;

2. using personal information for automated decision-making;

3. entrusting others to process personal information, providing other handlers with personal information and publicly disclosed personal information;

4. transferring personal information overseas; and

5. conducting other personal information processing activities that have a significant impact on individuals’ rights.

1. whether the purpose, manner and other aspects of processing personal information are legitimate, proper and necessary;

2. the impact on individuals’ right and the risk level; and

3. whether the security measures adopted are legitimate, effective and appropriate to the risk level.

1. passing a security assessment organized (only applicable to critical information infrastructure operators (CIIO) and handlers processing personal information reaching a certain quantity threshold.);

2. undergoing personal information protection certification; or

3. concluding a contract with the data importer in accordance with a standard contract formulated by the state cyberspace administration.

1. the right to be informed;

2. the right to decision;

3. the right to restriction and objection;

4. the right to access and copy;

5. the right to rectification;

6. the right to deletion;

7. the right to data portability;

8. the right to refuse automated decision-making.

Sign a data processing agreement or contractual terms with the entrusted processor to agree on the purpose, period, and method of the contracted processing, the type of personal information to be processed, any protection measure to be taken, and the rights and obligations of both parties, etc.;

Supervise the activities of processing of personal information carried out by the entrusted processor (such as through data compliance audit);

and Conduct a PIPIA in advance and record the processing situation.

Vendors accepting entrusted processing of personal information shall, according to the provisions of PIPL and relevant laws and administrative regulations, take necessary measures to safeguard the security of the personal information they process, and assist personal information handlers in fulfilling the obligations provided in PIPL.

Formulate and organize the implementation of security incident response plans to ensure compliance.

Prevent unauthorized access as well as personal information leaks, distortion, or loss.

1. the categories of personal information, the reason and the damages that may be caused of what has or may have been leaked, tampered with or lost;

2. the remedial measures that are taken by the personal information handler and the measures available to an individual to mitigate the damages; and 3. the contact information of the handler