Several Provisions on Automotive Data Security Management (Trial)

When processing personal information the processor must inform individuals, through conspicuous means such as the user manual, in-vehicle display panel, voice prompts or the vehicle app, of: the categories of personal information processed, including trajectory, driving habits, audio, video, images and biometric characteristics; the specific contexts in which each category is collected and how to stop collection; the purposes, uses and methods of processing; the storage location and retention period or the rules determining them; how to access and copy the personal information and to delete it in the vehicle or request deletion of information already provided outside the vehicle; the name and contact details of the user rights contact person; and any other matters required by law or administrative regulation.

Applies when

All automotive data processors, including vehicle manufacturers, component and software suppliers, dealers, repair institutions and mobility service companies.

Evidence to retain

• · Copy and placement inventory covering the seven notice items across manual, head unit, voice and app
• · Archived screenshots of the in-vehicle and app notices
• · Appointment document for the user rights contact person and the record of publishing the details
• · Functional test records for the stop-collection control

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Processing personal information requires the individual consent or another statutory basis. Where personal information outside the vehicle is collected for driving safety and cannot be consented to but is provided outside the vehicle, it must be anonymised, including by deleting frames that can identify a natural person or by applying local contouring to facial information. For sensitive personal information the processor must additionally: have a purpose directly serving the individual, including enhancing driving safety, intelligent driving or navigation; conspicuously inform of the necessity and the impact on the individual; obtain separate consent, with the individual free to set the consent period; indicate the collection status in an appropriate manner while preserving driving safety and make it easy to terminate collection; and delete the information within ten working days where the individual so requests. Fingerprint, voiceprint, facial and heart rhythm biometric data may be collected only where there is a driving safety purpose and sufficient necessity.

Applies when

Teams collecting cabin audio and video, driver or occupant monitoring facial data, voiceprints or heart rhythm biometrics, or capturing off-vehicle video and images.

Evidence to retain

• · Interaction design and stored consent records for separate consent, including the user-set consent period
• · Necessity justification for collecting biometric characteristics
• · Anonymisation scheme for off-vehicle personal information and its effectiveness validation report
• · Test records for the collection status indicator and the terminate-collection function
• · Deletion request ledger showing performance against the ten-working-day deadline

Estimated first-time effort: 15–40 person-days (estimate, not a commitment)

An automotive data processor carrying out important data processing must conduct a risk assessment as prescribed and file the risk assessment report with the provincial cyberspace administration and relevant departments. The report must cover the types, volumes, scope, storage location and period and use of the important data processed, the data processing activities and whether the data is provided to third parties, the data security risks faced and the response measures. Companies must first map their data against the six enumerated categories, the two most easily missed being off-vehicle video and images containing faces or licence plates, and personal information involving more than 100,000 subjects.

Applies when

Vehicle manufacturers, automated driving suppliers and mobility service companies carrying out important data processing.

Evidence to retain

• · Item-by-item identification and determination record against the six important data categories
• · Important data inventory (types, volumes, scope, storage location and period, use)
• · Risk assessment report and the filing acknowledgement from the provincial cyberspace administration
• · Register of provision to third parties with the underlying agreements

Estimated first-time effort: 15–45 person-days (estimate, not a commitment)

Important data must be stored within China. Where a genuine business need requires providing it abroad, it must pass the security assessment organised by the national cyberspace department together with the relevant State Council departments; outbound management of personal information data not classified as important data follows the applicable laws and administrative regulations. Where an international treaty or agreement concluded or acceded to by China provides otherwise, that treaty or agreement applies, except for reserved clauses. Outbound provision of important data must not exceed the purpose, scope, means, data types and volumes confirmed in the security assessment; the authorities verify this by spot checks and the processor must cooperate and present the data in a readable and convenient form.

Applies when

Companies transferring Chinese road test data, scenario catalogues, cabin data or fleet operating data to overseas R&D centres, overseas cloud services or foreign partners.

Evidence to retain

• · Outbound data transfer security assessment filing and the assessment outcome
• · Domestic storage architecture description and data flow diagrams
• · Control checklist implementing the approved purpose, scope, means, data types and volumes
• · Demonstration record of the readable presentation capability for spot checks
• · Data processing agreement with the overseas recipient and onward transfer restrictions

Estimated first-time effort: 30–90 person-days (estimate, not a commitment)

Automotive data processors carrying out important data processing must report to the provincial cyberspace administration and relevant departments by 15 December each year: the names and contact details of the automotive data security management officer and the user rights contact person; the types, scale, purposes and necessity of the automotive data processed; the security protection and management measures including storage location and period; the provision of automotive data to domestic third parties; automotive data security incidents and how they were handled; user complaints relating to automotive data and their handling; and other matters specified by the authorities. Processors providing important data abroad must additionally report the basic situation of the recipient, the types, scale, purpose and necessity of the outbound data, the storage location, period, scope and means abroad, user complaints relating to outbound provision and their handling, and other matters specified by the authorities.

Applies when

Automotive data processors carrying out important data processing, with additional reporting content where important data is provided abroad.

Deadline: By 15 December each year

Evidence to retain

• · Annual automotive data security management report and the filing acknowledgement
• · Appointment documents for the data security management officer and the user rights contact person
• · Register of provision to domestic third parties
• · Ledger of data security incidents and user complaint handling
• · For outbound transfers, documentation of the recipient and of the storage location, period, scope and means abroad

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Automotive data processors must set up complaint and reporting channels with a convenient entry point and handle user complaints and reports promptly, and bear liability where lawful user rights or the public interest are harmed. The national cyberspace department and the development and reform, industry and information technology, public security and transport departments conduct data security assessments of automotive data processors according to their remits and the data processing situation, and the processor must cooperate; institutions and personnel taking part in the assessment owe confidentiality obligations for trade secrets and undisclosed information learned during it.

Applies when

All automotive data processors.

Evidence to retain

• · Complaint and reporting entry point and the response time policy
• · Complaint handling ledger and case closure records
• · Named liaison and document checklist for cooperating with authority data security assessments
• · Records of trade secret protection handling during the assessment

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)