China's Personal Information Protection Law (PIPL)
Key highlights of China's PIPL:
Know the difference between Virginia’s CDPA, CCPA and CPRA?
Download this whitepaper to know more about the key differences between the provisions of Virginia’s new privacy law called CDPA, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). It provides an overview of each law’s requirements, highlighting their similarities and differences. Although there are some similarities in all the active privacy laws, the framework, and definitions of CDPA carries its unique requirements and guidance.
China’s PIPL Data Subject Rights: (Article 44-50)
Under PIPL, individuals have the following rights:
- Right to know: Individuals have the right to know and make decisions about the processing of their personal information. (Article 44)
- Right to restrict or refuse the processing of their personal information: Individuals have the right to restrict or refuse the processing of their personal information by others. (Article 44)
- Right to data portability: Individuals have the right to consult and copy their personal information to the personal information processor. (Article 45)
- Right to recertify/rectify: If an individual discovers that his personal information is inaccurate or incomplete, he has the right to request the personal information processor to correct or supplement it. (Article 46)
- Right to deletion: Individuals have right to deletion to personal information. (Article 47)
- Right to understand the processing rules of processor: Individuals have the right to request personal information processors to explain their personal information processing rules. (Article 48)
Legal basis: (Article 13)
Processing of Personal information shall be valid only if one of the following circumstances is met:
- Personal consent: Obtained personal consent.
- Performance of a contract: Necessary for the conclusion and performance of a contract in which an individual is a party, or necessary for the implementation of human resource management.
- Statutory duties or statutory obligations: Necessary to perform statutory duties or statutory obligations.
- Vital interest: Necessary to respond to public health emergencies, or to protect the life.
- Public interest: Carry out news reports, public opinion supervision and other acts for the public interest.
- Self-disclosed or legally disclosed personal information: Processing personal information disclosed by individuals or other legally disclosed personal information.
- Other circumstances stipulated by laws and administrative regulations.
Cross-border transfer of personal information: (Article 38-43)
If the processor needs to provide personal information outside the People’s Republic of China due to business needs, it shall meet one of the following conditions:
- Provide individuals with certain specific information about the transfers and obtaining separate consent.
- Adopt necessary measures to ensure that the overseas recipients can provide the same level of protection as required under the PIPL.
- Carry out a personal information protection impact assessment.
- Other conditions stipulated by laws, administrative regulations, or the national cyberspace administration department.
Data Protection Impact Assessment: (Article 55)
In the following situations, personal information protection impact assessment is required to be conducted in advance and record the processing situation:
- Processing sensitive personal information.
- Using personal information to make automated decision-making.
- Entrust the processing of personal information, provide personal information to other personal information processors, and disclose personal information.
- Providing personal information abroad.
- Other personal information processing activities have a significant impact on personal rights and interests.
How Mandatly helps you achieve China's PIPL compliance?
Mandatly’s PIPL compliance solution goes above and beyond automation and includes comprehensive privacy risk management features that enable you to make effective business decisions and eliminate privacy risks.