CHINA Trends and Developments Contributed by: Vincent Wang, Xinyao Zhao and Alfred Feng, Global Law Office
of sensitive personal information has become a soap drama in practice. Article 28 of the PIPL defines it as personal informa - tion that is likely to result in damage to the personal dignity of any natural person or damage to their per - sonal or property safety once disclosed or illegally used. As this definition is vague, in practice, most data processors will use the list of examples of sensi - tive personal information in Annex B of the national standard “Information security technology – personal information security specification” (GB/T 35273-2020, the “Information Security Specification”) as a key ref - erence in determining sensitive personal information. Though the Information Security Specification is only a recommended standard that showcases the recom - mended best practice, Chinese authorities explicitly use it anyway to determine sensitive personal informa - tion for law enforcement purposes. A good example of such a practice is the sensitive personal information defined in the official standard contract template for cross-border personal information transfer. In 2025, a new national standard related to the determination of sensitive personal information was released, namely the Data security technology – Secu - rity requirements for processing of sensitive personal information (GB/T 45574-2025, the “Security Require - ments for Sensitive Personal Information”). It not only provides a new list of sensitive personal information but also includes a new standard to determine sensi - tive personal information that is theoretically under - standable for perfection but difficult to implement in practice. According to such a standard, if several types of non-sensitive personal information can be collectively used to cause an impact on personal dig - nity, personal safety or property safety, such a com - bination of non-sensitive personal information should also be considered as sensitive personal information. Therefore, according to the Security Requirements for Sensitive Personal Information, data processors cannot only rely on a standard list to determine the sensitivity of personal information, but should con - sider the after-the-fact use and resulting impacts of the use of the non-sensitive personal information to determine whether such non-sensitive personal infor -
mation should be otherwise re-determined as sensi- tive personal information. Apparently, it is a subjective standard – but it does not explain to whose mind it should be subject. Deter - mination of sensitive personal information remains a puzzle, a more difficult one to solve, unfortunately. Personal information protection compliance audit The Personal Information Protection Compliance Audit is a requirement under the PIPL since 2021. The long-awaited practical rules to fulfil the audit require - ment were released in the Administrative Measures on Personal Information Protection Compliance Audit (the “PIPCA Measures”) on 12 February 2025, which came into effect on 1 May 2025. The PIPCA Meas - ures provide (in the annex) that the audit should cover 26 key areas, which virtually covers all compliance aspects regarding personal information processing. The good news is that the PIPCA Measures only require that data processors processing personal information of over 10 million individuals must con - duct a PIPCA at least every two years, either on their own or by an authorised external professional institu - tion. There is no set time and frequency for other data processors to complete it so far, at least in the literacy of the law. However, in certain areas, time limits may be imposed on data processors. For example, on 29 December 2025, the CAC released the Announcement on the Submission of Compliance Audit Results for the Protection of Personal Information of Minors (the “Announcement”). The Announcement requires all data processors that process personal information of minors under the age of 18 to conduct audits regard - ing minors’ personal information processing, and the result of the audit should be uploaded to CAC’s official website before 31 January 2026. Such short notice makes compliance with this unexpected requirement a serious challenge for all data processors that pro - cess personal information of minors. Supervision of facial recognition technology In 2025, facial recognition technology was a focus of the Chinese authorities. The Administrative Meas - ures on the Application Security of Facial Recogni -
65 CHAMBERS.COM
Powered by FlippingBook