Personal Information Protection Law

Pin each processing activity to one of the lawful bases in Art. 13 (consent; necessity for a contract to which the individual is a party; a statutory duty; public-health emergencies; news reporting in the public interest; reasonable handling of lawfully published information, etc.), and before processing give prominent, plain-language notice of the processor’s name and contact details, the purposes and methods, the categories of data and the retention period, and how to exercise rights; re-notify when any of this changes. Where notice is given through a processing rule (privacy policy), that rule must be public and easy to consult and retain.

Applies when

Any organisation processing personal information in the PRC, and any offshore organisation falling within Art. 3 §2.

Evidence to retain

• · Register of processing activities, each tagged with its Art. 13 lawful basis
• · Public privacy policy / processing rules with version history and effective dates
• · Screenshots of the consent interface and consent logs (timestamp, policy version)
• · Records of re-notification when notified items changed

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

For biometric data (face, voiceprint, fingerprint), medical and health data, financial accounts, location traces and the data of minors under 14, first document a “specific purpose + sufficient necessity + strict protective measures” justification, then obtain separate consent that is not bundled into a blanket consent, and additionally disclose the necessity of the processing and its impact on the individual. Where a law or administrative regulation requires written consent, that requirement prevails.

Applies when

Any business processing sensitive personal information. Common for AI companies: face and voiceprint products, health and medical models, in-vehicle camera and location data, and companion applications aimed at minors.

Evidence to retain

• · Written necessity justification for sensitive processing, naming the specific purpose and the alternatives considered
• · Design note and captured screens showing how separate consent is collected
• · Separate-consent logs kept distinct from general consent records
• · Guardian consent records and the age-assurance approach for under-14 users
• · Inventory of strict protective measures (encryption, de-identification, least-privilege access)

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Automated decision-making must be transparent and fair in outcome, and must not impose unreasonable differential treatment on transaction terms such as price. Where automated decision-making is used to push information or marketing, the processor must at the same time offer an option not based on the individual’s characteristics, or a convenient way to refuse. Where an automated decision has a significant effect on an individual’s rights, the individual may demand an explanation and may refuse a decision made solely by automated means.

Applies when

Recommendation and ranking systems, AI pricing and risk control, CV-screening and credit-approval models, and agent products driven by user profiling.

Evidence to retain

• · Inventory of automated decisions (scenario, input features, output impact, whether significant)
• · Self-assessment report on differential treatment, with fairness test results across price, limit and exposure
• · Product screenshots and release records for the non-profiled option or one-click off switch
• · Explanation template and human-review workflow for decisions with significant effect

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Run a prior impact assessment and keep a record of the processing in five situations: processing sensitive personal information; automated decision-making; entrusting processing to, providing data to, or publicly disclosing data to another processor; transferring data abroad; and any other processing with a significant effect on individuals. The assessment must at minimum cover the lawfulness, legitimacy and necessity of the purpose and method, the impact on individuals and the security risks, and whether the protective measures are lawful, effective and proportionate to the risk. The report and processing records must be kept for at least three years.

Applies when

Most AI companies trigger several limbs at once: sensitive data in training sets, a recommendation system amounting to automated decision-making, and calling an offshore model API amounting to an outbound transfer.

Evidence to retain

• · PIPIA report structured around the three elements of Art. 56
• · Trigger-mapping table showing which limb prompted which assessment
• · Processing records covering data flows, recipients and retention periods
• · Remediation log arising from the assessment, with closure evidence
• · Archive index demonstrating the three-year retention

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

A processor handling personal information above the volume set by the CAC must appoint a personal information protection officer, publish the officer’s contact details and report the officer’s name and contact details to the competent authority. The Compliance Audit Measures put numbers on this: processors handling more than 1 million individuals’ data must appoint such an officer, who owns the audit work; processors handling more than 10 million individuals’ data must run a compliance audit at least once every two years. The authority may also require an audit by an accredited external firm, after which the report must be filed and a remediation report submitted within 15 working days of completing the fixes.

Applies when

Consumer AI apps, model platforms and SaaS vendors above one million users, and algorithm or data-service vendors that process large volumes of personal information on customers’ behalf even with a small direct user base.

Deadline: At least once every two years above 10 million individuals; where an audit is mandated, the remediation report is due within 15 working days of completing the fixes.

Applies from: 2025-05-01

Evidence to retain

• · Appointment letter for the protection officer and a screenshot of the public disclosure page
• · Filing receipt for reporting the officer’s name and contact details to the authority
• · Compliance audit report (in-house or by an accredited firm)
• · Remediation log for audit findings and the receipt for the remediation report
• · Methodology note and monthly counts for the number of individuals whose data is processed

Estimated first-time effort: 15–40 person-days (estimate, not a commitment)

Stand up an intake-and-response mechanism covering access, copies, correction, supplementation, deletion, restriction or refusal of processing, withdrawal of consent and account closure, and satisfy requests promptly. Where a transfer request meets the conditions set by the CAC, provide a channel to move the data to a processor named by the individual. Delete proactively where the purpose has been achieved, the product or service has ceased, the retention period has expired, consent has been withdrawn, or the processing breached the law or the contract; where deletion is technically infeasible, stop all processing other than storage and necessary security measures.

Applies when

All AI products serving individual users, including model conversation logs, user data in vector stores and samples already inside training pipelines.

Evidence to retain

• · Documented intake workflow for rights requests with a response-time SLA
• · Ticket log for requests, recording identity verification, outcome and completion time
• · Technical note on deletion and anonymisation, including how vector stores and training sets are traced back
• · Specification of the portability interface, or a record of the reasons for refusal

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Where personal information is or may have been leaked, tampered with or lost, take remedial action immediately and notify both the competent authority and the affected individuals. The notice must state the categories of data, the cause and the likely harm; the remedial measures taken and the steps individuals can take to mitigate harm; and the processor’s contact details. Individual notice may be omitted where the measures taken effectively avert harm, but the authority may still require it.

Applies when

Any business holding personal information. Frequent AI scenarios: leaked prompts and conversation logs, unauthorised access to vector stores, and leaks at third-party annotation vendors.

Deadline: Remediation and notification must be “immediate”; no fixed hour count. The Network Data Security Management Regulations separately impose a 24-hour report for product or service risks that endanger national security or the public interest.

Evidence to retain

• · Personal-data incident response plan and drill records
• · Severity classification records, including whether the notification threshold was met and why
• · Text of the notice to the authority and the filing receipt
• · Text of the notice to individuals, the channels used and delivery statistics; or the justification for withholding individual notice
• · Post-incident review report and closure evidence for remediation items

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)