Apply for 30 mins FREE Consulting!
Presidential Decree No. 91
The Personal Information Protection Law of the People’s Republic of China, adopted at the 30th Session of the Standing Committee of the 13th National People’s Congress of the People’s Republic of China on August 20, 2021, is hereby promulgated, effective November 1, 2021.
Xi Jinping
President of the People’s Republic of China
August 20, 2021
(Adopted at the 30th Session of the Standing Committee of the 13th National People’s Congress on August 20, 2021)
Chapter 1
General Provisions
Article 1 This Law is enacted in accordance with the Constitution to protect the rights and interests of personal information, regulate the handling of personal information and promote the reasonable use of personal information.
Article 2 The personal information of a natural person shall be protected by law, and no organization or individual may infringe upon the personal information rights and interests of natural persons.
Article 3 This Law shall apply to the handling of the personal information of natural persons within the territory of the People’s Republic of China.
This Law shall also apply to the handling of the personal information of natural persons within the territory of the People’s Republic of China outside the territory of the People’s Republic of China under any of the following circumstances:
- where the purpose is to provide domestic natural persons with products or services;
- where the activities of domestic natural persons are analyzed and evaluated; and
- other circumstances as prescribed by laws and administrative regulations.
Article 4 Personal information refers to all kinds of information related to identified or identifiable natural persons recorded by electronic or other means, excluding the information handled anonymously.
The handling of personal information includes the collection, storage, use, processing, transmission, provision, disclosure and deletion, etc. of personal information.
Article 5 The handling of personal information shall follow the principles of lawfulness, legitimacy, necessity and good faith, and it is not allowed to handle personal information by misleading, fraud, coercion or otherwise.
Article 6 The handling of personal information shall be for a definite and reasonable purpose, be directly related to the purpose of handling and shall be conducted in a way that minimizes the impact on personal rights and interests.
The collection of personal information shall be limited to the minimum scope for achieving the purpose of handling and it is not allowed to excessively collect personal information.
Article 7 The handling of personal information shall follow the principles of openness and transparency, make public the rules for handling personal information and expressly indicate the purpose, method and scope of such handling.
Article 8 The quality of personal information shall be ensured in the handling of personal information to avoid the adverse impact on personal rights and interests caused by inaccurate or incomplete personal information.
Article 9 A personal information handler shall be responsible for its handling of personal information and take necessary measures to ensure the security of the personal information handled.
Article 10 No organization or individual may illegally collect, use, process or transmit the personal information of others, illegally buy or sell, provide or make public the personal information of others, or engage in the handling of personal information that endangers the national security or public interests.
Article 11 The State establishes a sound personal information protection system, prevents and punishes the infringement upon personal information rights and interests, strengthens the publicity and education on personal information protection, and promotes the formation of a good environment in which the government, enterprises, relevant social organizations and the public jointly participate in personal information protection.
Article 12 The State actively participates in the development of international rules for personal information protection, promotes the international exchange and cooperation in personal information protection, and promotes the mutual recognition of the rules and standards for personal information protection with other countries, regions and international organizations.
Chapter 2
Rules for Handling Personal Information
Section 1 General Provisions
Article 13 Only under any of the following circumstances may a personal information handler handle personal information:
- where the consent of the individual concerned is obtained;
- where it is necessary for the conclusion or performance of a contract to which the individual concerned is a party, or for the implementation of human resources management in accordance with the labor rules and regulations formulated in accordance with the law and the collective contract concluded in accordance with the law;
- where it is necessary for the performance of statutory duties or statutory obligations;
- where it is necessary for the response to a public health emergency or for the protection of the life, health and property safety of a natural person in an emergency;
- where such acts as news reporting and supervision by public opinions are carried out for the public interest, and the handling of personal information is within a reasonable scope;
- where it is necessary to handle the personal information disclosed by the individual concerned or other personal information that has been legally disclosed within a reasonable scope in accordance with the provisions of this Law; and
- other circumstances prescribed by laws and administrative regulations.
The handling of personal information shall be subject to the consent of the individual concerned in accordance with other relevant provisions of this Law, however, the consent of the individual concerned is not required under the circumstances set forth in Items (II) to (VII) of the preceding paragraph.
Article 14 Where the handling of personal information is based on the consent of the individual concerned, such consent shall be given by the individual concerned in a voluntary and explicit manner in the condition of full knowledge. Where laws and administrative regulations provide that the handling of personal information shall be subject to the separate consent or written consent of the individual concerned, such provisions shall prevail.
Where the purpose or method of handling personal information or the type of personal information to be handled changes, the consent of the individual concerned shall be obtained again.
Article 15 Where the handling of personal information is based on the consent of the individual concerned, the individual is entitled to withdraw his/her consent. The personal information handler shall provide a convenient method for the individual to withdraw his/her consent.
Withdrawal of consent by the individual concerned does not affect the validity of any personal information handling activity conducted based on the consent of the individual before such withdrawal.
Article 16 A personal information handler shall not refuse to provide products or services for an individual on the grounds that the individual does not agree to handle his/her personal information or withdraws his/her consent, unless the handling of personal information is necessary for providing products or services.
Article 17 Prior to the handling of an individual’s personal information, the personal information handler shall truthfully, accurately and completely inform the individual of the following matters in a conspicuous manner and in clear and understandable language:
- the title or name and contact information of the personal information handler;
- the purpose and method of handling personal information, and the type and retention period of the handled personal information;
- the method and procedure for the individual to exercise the rights provided for in this Law; and
- other matters that shall be informed in accordance with the provisions of laws and administrative regulations.
Where any of the matters specified in the preceding paragraph is changed, the individual shall be notified of such change.
Where a personal information handler informs individuals of the matters specified in the first Paragraph by formulating rules on handling personal information, such rules shall be open to the public for easy access and storage.
Article 18 A personal information handler is allowed not to inform the individual concerned of the matters prescribed in Paragraph 1 of the preceding article if there are circumstances in which the personal information should be kept confidential as required by laws or administrative regulations or does not need to be informed.
Where it is unable to timely inform the individual concerned in an emergency for the purpose of protecting the life, health and property safety of natural persons, the personal information handler shall timely inform the individual after the elimination of the emergency.
Article 19 Unless otherwise stipulated by laws and administrative regulations, the retention period of personal information shall be the minimum period necessary for achieving the purpose of handling.
Article 20 Where two or more personal information handlers jointly determine the purpose and method of handling personal information, their respective rights and obligations shall be agreed upon. However, such agreement shall not affect an individual’s request to any of the personal information handlers to exercise the rights stipulated in this law.
Where personal information handlers who jointly handle personal information, thus infringing upon personal information rights and interests and causing damage shall bear joint and several liability in accordance with the law.
Get more information tailored to your needs by click Here.
