Personal Information Protection Law of the People's Republic of China
Personal Information Protection Law of the People's Republic of China
Personal Information Protection Law of the People's Republic of China
Order of the President of the People's Republic of China No.91
August 20, 2021
The Personal Information Protection Law of the People's Republic of China, adopted at the 30th Session of the Standing Committee of the 13th National's People's Congress of the People's Republic of China on August 20, 2021, is hereby issued, effective from November 1, 2021.
Xi Jinping, President of the People's Republic of China
Personal Information Protection Law of the People's Republic of China
(Adopted at the 30th Session of the Standing Committee of the 13th National's People's Congress of the People's Republic of China on August 20, 2021)
TABLE OF CONTENTS
Chapter I General Provisions
Chapter II Rules of Processing of Personal Information
Section 1 General Rules
Section 2 Rules of Processing of Sensitive Personal Information
Section 3 Special Provisions on Processing of Personal Information by State Agencies
Chapter III Rules of Cross-border Provision of Personal Information
Chapter IV Rights of Individuals in Activities of Processing of Personal Information
Chapter V Obligations of Personal Information Processors
Chapter VI Authorities Performing Personal Information Protection Duties
Chapter VII Legal Liability
Chapter VIII Supplementary Provisions
Chapter I General Provisions
Article 1 This Law is enacted in accordance with the Constitution to protect personal information rights and interests, regulate activities of processing of personal information, and promote a reasonable use of personal information.
Article 2 The personal information of any natural person shall be protected by law, and no organization or individual may infringe upon the personal information rights and interests of any natural person.
Article 3 This Law shall apply to any activity of processing of personal information of a natural person that is carried out within the territory of the People's Republic of China.
This Law shall also apply to any activity of processing of personal information of any natural person located within the territory of the People's Republic of China that is carried out outside the territory of the People's Republic of China under any of the following circumstances:
1. Where the purpose of the activity is to provide a product or service to that natural person located within China;
2. Where the purpose of the activity is to analyze or assess the behavior of that natural person located within China; or
3. Any other circumstance as provided by law or administrative regulations.
Article 4 Personal information refers to any kind of information related to an identified or identifiable natural person as electronically or otherwise recorded, excluding information that has been anonymized.
Processing of personal information includes the collection, storage, use, processing, transmission, provision, disclosure, and deletion of personal information.
Article 5 Personal information shall be processed in accordance with the principles of lawfulness, legitimacy, necessity and good faith, and not in any manner that is misleading, fraudulent or coercive.
Article 6 Processing of personal information shall be for a specified and reasonable purpose, and shall be conducted for a purpose directly relevant to the purpose of processing and in a way that has the least impact on personal rights and interests.
Collection of personal information shall be limited to the minimum scope necessary for achieving the purpose of processing and shall not be excessive.
Article 7 Personal information shall be processed in accordance with the principles of openness and transparency, with the rules of processing of personal information disclosed, and the purpose, method and scope of processing expressly stated.
Article 8 The quality of personal information shall be ensured when the personal information is processed in order to avoid any negative impact on personal rights and interests due to any inaccuracy or incompleteness of the personal information processed.
Article 9 Personal information processors shall be responsible for their activities of processing of personal information, and take necessary measures to ensure the security of the personal information processed.
Article 10 No organization or individual may illegally collect, use, process, or transmit any personal information of another person, or illegally deal in, provide, or disclose any personal information of another person; or engage in any activity of processing of personal information that endangers national security or public interests.
Article 11 The State will establish a sound personal information protection regime to prevent and punish any act of infringement of personal information rights and interests, strengthen publicity and education on personal information protection, and promote the creation of a sound environment for the government, enterprises, relevant trade organizations, and the public to jointly participate in personal information protection.
Article 12 The State will actively participate in the development of international rules for personal information protection, promote international exchange and cooperation in personal information protection, and promote the mutual recognition of the rules and standards of personal information protection with other countries, regions, and international organizations.
Chapter II Rules of Processing of Personal Information
Section 1 General Rules
Article 13 A personal information processor may process personal information of an individual only under any of the following circumstances:
1. Where consent is obtained from the individual;
2. Where it is necessary for the conclusion or performance of a contract to which the individual is a contracting party, or where it is necessary for carrying out human resources management under an employment policy legally established or a collective contract legally concluded;
3. Where it is necessary for performing a statutory responsibility or statutory obligation;
4. Where it is necessary for responding to a public health emergency, or for protecting the life, health or property safety of the natural person in the case of an emergency;
5. Where the personal information is processed within a reasonable scope to carry out any news reporting, supervision by public opinions or any other activity for public interest purposes;
6. Where the personal information, which has already been disclosed by the individual or otherwise legally disclosed, is processed within a reasonable scope and in accordance with this Law; or
7. Any other circumstance as provided by law or administrative regulations.
Personal consent shall be obtained for the processing of personal information as required by the other provisions of this Law, but where any of the preceding Items 2 to 7 is applicable, personal consent is not required.
Article 14 Where personal information is to be processed based on consent of an individual, such consent shall be a voluntary and explicit indication of intent given by such individual on a fully informed basis. Where specific consent or written consent shall be obtained from individuals for the processing of their personal information as provided by any law or administrative regulations, such provision shall prevail.
In the event of any change of the purpose or method of processing or the type of personal information to be processed, personal consent shall be obtained anew.
Article 15 Individuals shall have the right to withdraw their consent to the processing of their personal information carried out based on their consent. Personal information processors shall provide an easy way to withdraw consent.
A withdrawal of consent by individuals shall not affect the validity of any activity of processing of their personal information already carried out before the withdrawal based on their consent.
Article 16 Personal information processors shall not refuse to provide a product or service to individuals on the grounds that they do not consent to the processing of their personal information or they withdraw their consent, unless the processing of personal information is necessary for providing the product or service.
Article 17 Prior to the processing of personal information of an individual, a personal information processor shall inform the individual of the following matters in a conspicuous way, in clear and easy-to-understand language, and in a truthful, accurate and complete manner:
1. The organizational or personal name and contact information of the personal information processor;
2. The purpose and method of processing personal information, the type of personal information to be processed and its retention period;
3.
......
Order of the President of the People's Republic of China No.91
August 20, 2021
The Personal Information Protection Law of the People's Republic of China, adopted at the 30th Session of the Standing Committee of the 13th National's People's Congress of the People's Republic of China on August 20, 2021, is hereby issued, effective from November 1, 2021.
Xi Jinping, President of the People's Republic of China
Personal Information Protection Law of the People's Republic of China
(Adopted at the 30th Session of the Standing Committee of the 13th National's People's Congress of the People's Republic of China on August 20, 2021)
TABLE OF CONTENTS
Chapter I General Provisions
Chapter II Rules of Processing of Personal Information
Section 1 General Rules
Section 2 Rules of Processing of Sensitive Personal Information
Section 3 Special Provisions on Processing of Personal Information by State Agencies
Chapter III Rules of Cross-border Provision of Personal Information
Chapter IV Rights of Individuals in Activities of Processing of Personal Information
Chapter V Obligations of Personal Information Processors
Chapter VI Authorities Performing Personal Information Protection Duties
Chapter VII Legal Liability
Chapter VIII Supplementary Provisions
Chapter I General Provisions
Article 1 This Law is enacted in accordance with the Constitution to protect personal information rights and interests, regulate activities of processing of personal information, and promote a reasonable use of personal information.
Article 2 The personal information of any natural person shall be protected by law, and no organization or individual may infringe upon the personal information rights and interests of any natural person.
Article 3 This Law shall apply to any activity of processing of personal information of a natural person that is carried out within the territory of the People's Republic of China.
This Law shall also apply to any activity of processing of personal information of any natural person located within the territory of the People's Republic of China that is carried out outside the territory of the People's Republic of China under any of the following circumstances:
1. Where the purpose of the activity is to provide a product or service to that natural person located within China;
2. Where the purpose of the activity is to analyze or assess the behavior of that natural person located within China; or
3. Any other circumstance as provided by law or administrative regulations.
Article 4 Personal information refers to any kind of information related to an identified or identifiable natural person as electronically or otherwise recorded, excluding information that has been anonymized.
Processing of personal information includes the collection, storage, use, processing, transmission, provision, disclosure, and deletion of personal information.
Article 5 Personal information shall be processed in accordance with the principles of lawfulness, legitimacy, necessity and good faith, and not in any manner that is misleading, fraudulent or coercive.
Article 6 Processing of personal information shall be for a specified and reasonable purpose, and shall be conducted for a purpose directly relevant to the purpose of processing and in a way that has the least impact on personal rights and interests.
Collection of personal information shall be limited to the minimum scope necessary for achieving the purpose of processing and shall not be excessive.
Article 7 Personal information shall be processed in accordance with the principles of openness and transparency, with the rules of processing of personal information disclosed, and the purpose, method and scope of processing expressly stated.
Article 8 The quality of personal information shall be ensured when the personal information is processed in order to avoid any negative impact on personal rights and interests due to any inaccuracy or incompleteness of the personal information processed.
Article 9 Personal information processors shall be responsible for their activities of processing of personal information, and take necessary measures to ensure the security of the personal information processed.
Article 10 No organization or individual may illegally collect, use, process, or transmit any personal information of another person, or illegally deal in, provide, or disclose any personal information of another person; or engage in any activity of processing of personal information that endangers national security or public interests.
Article 11 The State will establish a sound personal information protection regime to prevent and punish any act of infringement of personal information rights and interests, strengthen publicity and education on personal information protection, and promote the creation of a sound environment for the government, enterprises, relevant trade organizations, and the public to jointly participate in personal information protection.
Article 12 The State will actively participate in the development of international rules for personal information protection, promote international exchange and cooperation in personal information protection, and promote the mutual recognition of the rules and standards of personal information protection with other countries, regions, and international organizations.
Chapter II Rules of Processing of Personal Information
Section 1 General Rules
Article 13 A personal information processor may process personal information of an individual only under any of the following circumstances:
1. Where consent is obtained from the individual;
2. Where it is necessary for the conclusion or performance of a contract to which the individual is a contracting party, or where it is necessary for carrying out human resources management under an employment policy legally established or a collective contract legally concluded;
3. Where it is necessary for performing a statutory responsibility or statutory obligation;
4. Where it is necessary for responding to a public health emergency, or for protecting the life, health or property safety of the natural person in the case of an emergency;
5. Where the personal information is processed within a reasonable scope to carry out any news reporting, supervision by public opinions or any other activity for public interest purposes;
6. Where the personal information, which has already been disclosed by the individual or otherwise legally disclosed, is processed within a reasonable scope and in accordance with this Law; or
7. Any other circumstance as provided by law or administrative regulations.
Personal consent shall be obtained for the processing of personal information as required by the other provisions of this Law, but where any of the preceding Items 2 to 7 is applicable, personal consent is not required.
Article 14 Where personal information is to be processed based on consent of an individual, such consent shall be a voluntary and explicit indication of intent given by such individual on a fully informed basis. Where specific consent or written consent shall be obtained from individuals for the processing of their personal information as provided by any law or administrative regulations, such provision shall prevail.
In the event of any change of the purpose or method of processing or the type of personal information to be processed, personal consent shall be obtained anew.
Article 15 Individuals shall have the right to withdraw their consent to the processing of their personal information carried out based on their consent. Personal information processors shall provide an easy way to withdraw consent.
A withdrawal of consent by individuals shall not affect the validity of any activity of processing of their personal information already carried out before the withdrawal based on their consent.
Article 16 Personal information processors shall not refuse to provide a product or service to individuals on the grounds that they do not consent to the processing of their personal information or they withdraw their consent, unless the processing of personal information is necessary for providing the product or service.
Article 17 Prior to the processing of personal information of an individual, a personal information processor shall inform the individual of the following matters in a conspicuous way, in clear and easy-to-understand language, and in a truthful, accurate and complete manner:
1. The organizational or personal name and contact information of the personal information processor;
2. The purpose and method of processing personal information, the type of personal information to be processed and its retention period;
3.
......