Personal Information Protection Law

第十三条 Lawful bases for processing

Processors may handle personal information if they obtain individual consent, or under six alternative conditions: necessity for contract performance or human resource management under lawful regulations, statutory obligations, emergency protection of life and safety, reasonable public interest activities including news reporting, and processing self-disclosed or legally public information. Consent is not required when these alternative conditions apply, even if other provisions normally require it.

第十四条 Consent requirements

Consent must be given voluntarily and explicitly, based on adequate information disclosure, and any law or regulation may require single or written consent. When the purpose, method or category of processing changes, the processor must obtain fresh consent.

第十五条 Right to withdraw consent

Individuals have the right to withdraw consent previously given, and processors must provide convenient mechanisms for withdrawal. Past processing performed before withdrawal remains valid.

第十六条 Non-discrimination for refusal

Processors cannot deny products or services because an individual refuses to allow information processing or withdraws consent, unless processing is essential to service delivery.

第十七条 Disclosure obligations

Before processing, handlers must inform individuals in clear, plain language about the processor's identity and contact details, processing purposes and methods, information categories and retention periods, how to exercise legal rights, and other legally required matters. Changes to these matters must be disclosed, and processing rules must be publicly available and easily accessible.

第十八条 Exceptions to disclosure

Processors may withhold disclosure if law requires confidentiality or exempts from notification. In emergency situations where timely notification is impossible to protect life, safety or property, notification must occur promptly after the emergency ends.

第十九条 Data retention duration

Entities processing personal information must retain it only for the shortest duration necessary to accomplish their stated purpose, unless other laws or regulations specify otherwise.

第二十条 Joint personal information processing

When multiple entities jointly determine the purpose and methods of processing, they must agree on their respective rights and duties, but individuals may exercise their legal rights against any one of them. Joint processors are jointly and severally liable for damages caused by violations of personal information rights.

第二十一条 Commissioned processing contracts

An entity engaging another to process personal information must agree on purpose, duration, methods, data types, protective measures, and respective rights and duties, and must supervise the processor's activities. The processor must comply with the contract terms, cannot exceed the agreed scope, must return or delete the data if the contract becomes ineffective, and cannot subcontract without explicit consent.

第二十二条 Transfer upon merger or dissolution

When personal information must be transferred due to merger, division, dissolution, or bankruptcy, the transferring entity must notify individuals of the recipient's name and contact information, and the recipient must continue the transferor's obligations. If the recipient changes the original purpose or methods, it must obtain fresh individual consent under the law.

第二十三条 Sharing personal information with others

Providing processed personal information to another entity requires notifying individuals of the recipient's name, contact details, purpose, methods, and data types, and obtaining separate individual consent. The recipient must process data only within the agreed scope, and must obtain fresh consent if changing the original purpose or methods.

第二十四条 Automated decision-making

Automated decision-making must ensure transparency and fairness, without unfair price or transaction term discrimination. Marketing and information push through automated decisions must offer non-targeted options or easy refusal mechanisms. When automated decisions significantly impact individual rights, individuals may demand explanation and may refuse decisions made solely by automated means.

第二十五条 Prohibition on public disclosure

Entities must not disclose personal information they process, except where the individual has separately consented.

第二十六条 Image and identification device installation

Installing image capture or personal identification devices in public places requires necessity for public safety, compliance with national regulations, and conspicuous warning signs. Collected images and identification information may only serve public safety purposes, unless the individual has separately consented.

第二十七条 Processing publicly disclosed information

Entities may process personal information that individuals have voluntarily disclosed or that is already legally public, except where individuals have clearly refused. Processing of already public information that significantly impacts individual rights requires the individual's consent under the law.

第二十八条 Definition of sensitive personal information

Sensitive personal information is defined as information that, if leaked or misused, could harm a person's dignity or endanger their physical safety or property, including biometric, religious, identity, health, financial account and location data, as well as information of minors under 14. Processors may only handle sensitive information when there is a specific purpose, genuine necessity, and strict protective measures are in place.

第二十九条 Consent for sensitive information

Processing sensitive personal information requires separate consent from the individual. Laws or administrative regulations that require written consent for processing sensitive information must be followed.

第三十条 Disclosure obligations for sensitive information

When processing sensitive personal information, processors must inform individuals of the necessity for such processing and its impact on their rights, in addition to disclosures required under another provision, unless an exception applies.

第三十一条 Personal information of minors under 14

Processing information of minors under 14 requires consent from their parents or guardians. Processors must also establish specific processing rules for handling such minors' personal information.

第三十二条 Administrative restrictions on sensitive information

When laws or administrative regulations require administrative permits or other restrictions for processing sensitive personal information, those requirements apply.

第三十三条 Applicability to state agencies

General provisions of this law apply to state agencies' personal information processing, with the special rules in this section taking precedence when they differ.

第三十四条 Scope of state agency processing

State agencies processing information to fulfill statutory duties must act within the authority and procedures prescribed by law and not exceed what is necessary for those duties.

第三十五条 Notification by state agencies

State agencies must comply with notification obligations when processing information for statutory duties, unless exceptions apply such as when notification would hinder the agency's performance of those duties.

第三十六条 Storage and cross-border transfer by state agencies

Personal information processed by state agencies must be stored within China, though cross-border transfer is permitted if a security assessment is conducted, with relevant agencies providing support as needed.

第三十七条 Organizations with public authority

Organizations authorized by law or regulation to perform public management functions are subject to the same rules as state agencies when processing personal information to fulfill statutory duties.

第三十八条 Conditions for cross-border transfer

Personal information processors needing to provide data outside China must meet at least one condition: pass security assessment by the state cyberspace authority, obtain protection certification from professional institutions per state guidelines, use standard contracts approved by the state authority, or satisfy other conditions set by law or the state authority. Processors must ensure foreign recipients meet the law's protection standards, and may follow international treaties or agreements that China has concluded or joined.

第三十九条 Notice and consent for transfer

When transferring personal information outside China, processors must inform individuals of the foreign recipient's name or identity, contact details, processing purpose and method, types of information, and how to exercise rights with the recipient, and must obtain separate individual consent.

第四十条 Storage and transfer requirements

Critical infrastructure operators and processors handling personal information in quantities specified by the state cyberspace authority must store information collected or generated in China domestically. Transfers outside China require security assessment by the state authority, except where law, regulations, or state authority rules otherwise permit.

第四十一条 Foreign authority requests

Chinese authorities handle requests from foreign judicial or law enforcement authorities based on applicable law and international treaties or agreements China has concluded or joined, or on reciprocal terms. Processors may not provide personal information stored in China to foreign judicial or law enforcement bodies without approval from Chinese authorities.

第四十二条 Restrictions on foreign entities

The state cyberspace authority may list foreign organizations or individuals in a restricted or prohibited information provision register and publicly announce it if they harm Chinese citizens' personal information rights or endanger national security or public interests, and may restrict or prohibit providing personal information to them.

第四十三条 Reciprocal measures

If any country or region takes discriminatory prohibition, restriction, or similar measures against China in personal information protection, China may take reciprocal measures against that country or region based on actual circumstances.

第四十四条 Individual rights over information

Individuals have rights to know about, decide on, and limit or refuse processing of their personal information, unless law or regulations provide otherwise.

第四十五条 Right to access and transfer personal information

Individuals may request to view or copy their personal information, except where article 18(1) or article 35 applies. Processors must provide this information promptly. When individuals request transfer of their information to another designated processor, processors must provide the transfer method if the conditions set by the national cyberspace authority are met.

第四十六条 Right to correct and supplement information

Individuals have the right to request correction or supplementation of inaccurate or incomplete personal information. When requested, processors must verify the information and correct or supplement it promptly.

第四十七条 Right to deletion of personal information

Processors must actively delete personal information, or individuals may request deletion, when: processing objectives are achieved, unachievable, or no longer necessary; the processor stops providing services or retention periods expire; the individual withdraws consent; the processor violates laws or agreements; or other legally-specified circumstances occur. If legal retention periods have not expired or deletion is technically infeasible, processors must stop all processing except storage and necessary security measures.

第四十八条 Right to explanation of processing

Individuals have the right to request that processors explain and clarify their personal information processing rules.

第四十九条 Rights of close relatives of deceased persons

After a natural person dies, their close relatives may exercise rights of access, copying, correction and deletion concerning the deceased's personal information to protect their own legitimate and proper interests, unless the deceased made different arrangements before death.

第五十条 Mechanism for exercising rights and dispute resolution

Processors must establish a convenient mechanism to receive and handle applications for individuals to exercise their rights, and must explain reasons for refusing such requests. Individuals may bring lawsuits in court if processors reject their requests.

第五十一条 Security measures and safeguarding requirements

Processors must adopt measures to ensure compliance with laws and prevent unauthorized access, disclosure, alteration or loss of personal information, based on factors such as processing purpose, method, information types and potential risks. These measures include establishing internal rules and procedures; classifying information; applying encryption or de-identification techniques; setting appropriate access controls and training staff; and developing emergency response plans for security incidents.

第五十二条 Data protection officer requirements

Processors handling personal information in quantities set by the national cyberspace authority must appoint a personal information protection officer to oversee processing activities and protective measures. Processors must publicly disclose the officer's contact details and report their name and contact information to the department responsible for personal information protection.

第五十三条 Overseas processor representation requirements

Foreign processors as defined in article 3(2) must establish a specialized institution or designate a representative within China to handle personal information protection matters, and must report the institution's name or representative's name and contact details to the department responsible for personal information protection.

第五十四条 Compliance audits

Processors of personal information must conduct periodic reviews of whether their processing complies with applicable laws and regulations.

第五十五条 Impact assessments required

Before processing, personal information processors must conduct impact assessments when processing sensitive information, using automated decision-making, delegating processing to others, sharing information with other processors or publicly, providing information abroad, or engaging in other processing activities with major effects on individuals' rights.

第五十六条 Assessment contents and retention

Impact assessments must examine whether processing goals and methods are lawful, proper and necessary, assess effects on individual rights and security risks, and evaluate whether safeguards are lawful, effective and proportionate to risks. Assessment reports and processing records must be retained for at least three years.

第五十七条 Breach notification requirements

When personal information leaks, is altered or is lost, or may be, processors must immediately take remedial action and notify responsible authorities and individuals, with notifications covering the incident type and cause, harm risks, remedies available, and contact information. Processors may omit notifying individuals if they take measures preventing harm, though responsible authorities may require notification if they believe harm is possible.

第五十八条 Major platform obligations

Large processors providing major internet platform services with massive users and complex business must establish personal information protection compliance systems with independent oversight, create platform rules aligned with public openness and fairness principles, cease service to platform providers violating laws, and regularly publish personal information protection social responsibility reports.

第五十九条 Data processor obligations

Processors receiving delegated personal information processing must take necessary steps to protect that information's security and help the delegating processor fulfil statutory obligations.

第六十条 Protection authority structure

National cyberspace administration departments coordinate and supervise personal information protection work, while government agencies at all levels handle protection and supervision within their respective areas. Local governments' department responsibilities are set according to national rules.

第六十一条 Authority responsibilities

Responsible authorities must conduct public education on personal information protection, receive and handle complaints and reports, test and publish results on application protection practices, investigate and address unlawful processing, and carry out other duties specified in laws.

第六十二条 Cyberspace authority coordination

The national cyberspace administration must coordinate departments to develop protection rules and standards, create specialized rules for small processors and sensitive information and new technologies like facial recognition and artificial intelligence, support secure identity authentication technologies, build protection service systems, and improve complaint and reporting mechanisms.

第六十三条 Measures by personal information protection authorities

Authorities responsible for personal information protection may question relevant parties, examine contracts and records related to processing activities, conduct site inspections, and check equipment or items used for processing. Equipment or items with evidence of unlawful use may be sealed or confiscated after written report and approval by the department's senior official. Parties must cooperate and cannot refuse or obstruct these enforcement activities.

第六十四条 Risk management and criminal referral

When authorities discover significant risks or security incidents in personal information processing, they may summon the processor's legal representative or senior official for a discussion, or require commissioning of professional compliance audits. Processors must implement corrective measures and eliminate hazards as required. Authorities must promptly refer any suspected criminal conduct to public security agencies.

第六十五条 Complaints and reporting mechanism

Any organization or person may file complaints or reports with authorities about unlawful personal information processing. Receiving authorities must promptly handle reports according to law and inform the complainant of the outcome. Authorities must publicly disclose contact methods for receiving complaints and reports.

第六十六条 Administrative penalties for violations

Authorities must order correction, issue warnings, confiscate illegal proceeds, and suspend or terminate services for applications involved in unlawful processing. Non-compliant violators face fines up to one million yuan, and responsible persons face fines between ten thousand and one hundred thousand yuan. For serious cases, provincial or higher authorities may impose fines up to fifty million yuan or five percent of last year's revenue, order business suspension or closure, report to relevant authorities for license revocation or business license withdrawal, and fine responsible persons ten thousand to one million yuan with possible bans from holding positions in related companies for specified periods.

第六十七条 Credit record entry

Violations of the law are recorded in credit archives and made public according to relevant legal and administrative regulations.

第六十八条 Government agency violations

When state agencies fail to fulfill personal information protection duties, their superior agencies or responsible authorities must order correction and impose disciplinary sanctions on directly responsible officials and employees. Protection department staff who negligently or abusively exercise their powers or act corruptly without constituting a crime receive administrative disciplinary sanctions.

第六十九条 Liability for damages

Where processing personal information harms a person's rights and the processor cannot prove the absence of fault, the processor bears compensation and tort liability. Damages are determined by the individual's actual losses or the processor's gains, or based on actual circumstances when losses and gains cannot be determined.

第七十条 Public interest litigation

When an information processor violates the law and infringes the rights of numerous individuals, the people's procuracy, consumer organizations specified by law, and organizations designated by the state internet information department may bring legal proceedings before the people's court.

第七十一条 Criminal and security penalties

Violations of the law that constitute public security offences result in administrative penalties, and violations that constitute crimes result in criminal prosecution.

第七十二条 Scope exclusions

Natural persons handling personal information for individual or household affairs are not subject to this law. The law does not apply to personal information processing by government bodies and relevant departments in statistical and archival activities, which remain subject to their own applicable regulations.

第七十三条 Definitions

Defines personal information processors as organizations or individuals who independently determine purposes and methods of processing. Automated decision-making means using computer programs to analyze and make decisions about individuals' behaviors, preferences, or economic, health, and credit conditions. De-identification is processing that makes information incapable of identifying a specific person without additional information.

第七十四条 Effective date

The law comes into force on November 1, 2021.