The People's Republic of China Personal Information Protection Law
(adopted at the 30th meeting of the Standing Committee of the 13th National People's Congress on August 20, 2021)
item Record
Chapter 1 General The following
Chapter 2Personal information processing rules
Section oneGeneral provisions
Section twoRegularities for sensitive personal information
Section threeSpecial regulations for state organs to handle personal information Determine
Chapter 3 Rules for cross-border personal information
Chapter 4 The rights of individuals in personal information processing activities
Chapter 5 Obligation of personal information processor
Chapter 6 Departments that perform personal information protection responsibilities
Chapter 7 Legal liability
Chapter 8 Attachment
Chapter 1 General
Article 1 In order to protect personal information rights, standardize personal information processing activities, and promote the rational use of personal information, this Law is formulated in accordance with the Constitution.
Article 2 The personal information of natural persons is protected by law, and no organization or individual may infringe on the personal information rights of natural persons.
Article 3 This Law shall apply to the activities of handling personal information of natural persons within the territory of the People's Republic of China.
This Law also applies if any of the following circumstances occurs when processing the personal information of natural persons in the People's Republic of China:
(I) For the purpose of providing products or services to natural persons in the country;
(II) Analyze and evaluate the behavior of natural persons in the country;
(II) Other circumstances stipulated by laws and administrative regulations.
Article 4 Personal information is various information related to identified or identifiable natural persons recorded electronically or other means, and does not include anonymous information.
The processing of personal information includes the collection, storage, use, processing, transmission, provision, disclosure, deletion, etc. of personal information.
Article 5 The processing of personal information shall follow the principles of lawfulness, legitimacy, necessity and integrity, and shall not process personal information through misleading, fraud, coercion, etc.
Article 6 The processing of personal information should have a clear and reasonable purpose, and should be directly related to the purpose of the processing, and adopt a method with the least impact on personal rights and interests.
Collecting personal information should be limited to the minimum scope of achieving the processing purpose, and personal information shall not be collected excessively.
Article 7 The processing of personal information shall follow the principles of disclosure and transparency, disclose the rules for processing personal information, and clearly state the purpose, method and scope of the processing.
Article 8 The quality of personal information should be guaranteed to avoid adversely affecting personal rights and interests due to inaccurate and incomplete personal information.
Article 9 Personal information processors shall be responsible for their personal information processing activities and take necessary measures to ensure the security of the personal information processed.
Article 10 No organization or individual may illegally collect, use, process, or transmit other people's personal information, and may not illegally buy, sell, provide or disclose other people's personal information; they may not engage in personal information processing activities that endanger national security and public interests.
Article 11 The state establishes and improves a personal information protection system, prevents and punishes behaviors that infringe on personal information rights and interests, strengthens personal information protection publicity and education, and promotes the formation of a good environment for the government, enterprises, relevant social organizations, and the public to participate in personal information protection.
Article 12 The state actively participates in the formulation of international rules for personal information protection, promotes international exchanges and cooperation in personal information protection, and promotes mutual recognition of personal information protection rules and standards with other countries, regions, and international organizations.
Chapter 2 Personal Information Processing Rules
Section 1 General Provisions
Article 13 Only if one of the following circumstances complies with one of the following circumstances, the personal information processor may process personal information:
(I) Obtain the consent of the individual;
(II) It is necessary to enter into and perform the contract of an individual as a party, or in accordance with the labor rules and regulations formulated in accordance with the law and the collective contract signed in accordance with the law collective contract signed in accordance with the law (II) It is necessary to enter into and perform the contract of an individual as a party, or in accordance with the labor rules and regulations formulated in accordance with the law and the collective contract signed in accordance with the law (II) l5 Necessary for implementing human resources management;
(III) Necessary for performing statutory duties or legal obligations;
(IV) Necessary for responding to public health emergencies or in emergencies to protect the life, health and property safety of natural persons;
(V) Perform news reporting, public opinion supervision and other behaviors for the public interest, and process personal information within a reasonable range;
(VI) Handle personal information disclosed by individuals within a reasonable range in accordance with the provisions of this Law;
(VIII) Handle personal information disclosed by individuals within a reasonable range in accordance with the provisions of this Law;
(VIII) Other circumstances stipulated by laws and administrative regulations.
In accordance with other relevant provisions of this Law, personal consent shall be obtained by processing personal information, but if there are any circumstances stipulated in the second to seven of the preceding paragraph, personal consent is not required.
Article 14 If the individual agrees to process personal information, the consent shall be made voluntarily and explicitly by the individual with full knowledge. If laws and administrative regulations stipulate that personal information should be handled with individual consent or written consent, the provisions shall follow.
If the purpose, processing method and type of personal information are changed, personal consent shall be obtained again.
Article 15 If a personal consent is processed based on the individual's consent, the individual has the right to withdraw his consent. Personal information processors should provide convenient ways to withdraw consent.
Retraction of consent will not affect the effectiveness of personal information processing activities carried out based on personal consent before withdrawal.
Article 16 Personal information processors shall not refuse to provide products or services on the grounds that individuals do not agree to the processing of their personal information or withdraw their consent; unless processing of personal information is necessary to provide products or services.
Article 17 Before processing personal information, a personal information processor shall inform the individual of the following matters truthfully, accurately and completely in a prominent and clear and understandable language:
(I) The name or name and contact information of the personal information processor;
(II) The purpose and processing method of personal information, the type of personal information processed, the retention period of
(III) The methods and procedures for individuals to exercise their rights stipulated in this Law;
(IV) Other matters that should be informed as stipulated by laws and administrative regulations.
If the matters stipulated in the preceding paragraph change, the individual shall be informed of the change part.
If a personal information processor informs the matters specified in the first paragraph by formulating personal information processing rules, the processing rules shall be made public and easy to view and save.
Article 18 If a personal information processor handles personal information, if there are circumstances that should be kept confidential or does not require notification, it may not inform the individual of the matters stipulated in the first paragraph of the previous article.
If the person cannot be informed in a timely manner in order to protect the life, health and property safety of natural persons in an emergency, the personal information processor shall promptly inform the person after the emergency is eliminated.
Article 19 Unless otherwise provided by laws and administrative regulations, the retention period of personal information shall be the shortest time necessary to achieve the purpose of processing.
Article 20 If more than two personal information processors jointly decide on the purpose and method of processing personal information, they shall agree on their respective rights and obligations. However, this agreement does not affect an individual's request from any of the personal information processors to exercise the rights stipulated in this Law.
Personal information processors jointly process personal information and infringe upon personal information rights and interests and cause damage, they shall bear joint and several liability in accordance with the law.
Article 21 If a personal information processor entrusts the processing of personal information, it shall agree with the trustee on the purpose, duration, processing method, type of personal information, protection measures, and the rights and obligations of both parties, etc. of the trustee, and supervise the trustee's personal information processing activities.
Trustee shall process personal information in accordance with the agreement and shall not process personal information beyond the agreed purpose, processing method, etc.; if the entrustment contract does not take effect, is invalid, is revoked or terminated, the trustee shall return the personal information to the personal information processor or delete it, and shall not retain it.
The trustee shall not transfer the entrust others to process personal information without the consent of the personal information processor.
Article 22 If a personal information processor needs to transfer personal information due to merger, division, dissolution, or bankruptcy, he shall inform the individual of the name or name and contact information of the recipient. The recipient shall continue to fulfill the obligations of the personal information processor. If the recipient changes the original purpose and method of processing, he shall obtain his personal consent again in accordance with the provisions of this Law.
Article 23 If a personal information processor provides the personal information it processes to other personal information processors, he shall inform the individual of the recipient's name or name, contact information, purpose of processing, method of processing and type of personal information, and obtain the individual's separate consent. The recipient shall process personal information within the scope of the above-mentioned processing purposes, processing methods and types of personal information. If the recipient changes the original purpose and method of processing, he shall obtain his personal consent again in accordance with the provisions of this Law.
Article 24 Personal information processors use personal information to make automated decisions, and should ensure the transparency of the decision and the results are fair and just, and should not implement unreasonable differential treatment for individuals in terms of transaction prices and other transaction conditions.
push information and commercial marketing to individuals through automated decision-making methods. At the same time, options that do not target their personal characteristics should be provided, or convenient rejection methods should be provided to individuals.
makes decisions that have a significant impact on personal rights and interests through automated decision-making. Individuals have the right to ask the personal information processor to explain and have the right to refuse the personal information processor to make decisions only through automated decision-making.
Article 25 Personal information processors shall not disclose the personal information they process, unless they obtain the individual's separate consent.
Article 26 Installing image collection and personal identity identification equipment in public places shall comply with relevant national regulations as necessary for maintaining public safety, and set up significant prompt signs. The collected personal images and identification information can only be used for the purpose of maintaining public safety and shall not be used for other purposes; except where individual consent is obtained.
Article 27 Personal information processors may process personal information that is disclosed by themselves or other legally disclosed within a reasonable scope; unless otherwise explicitly rejected by an individual. If the processing of the disclosed personal information has a significant impact on personal rights and interests, the personal consent shall be obtained in accordance with the provisions of this Law.
Section 2 Rules for processing sensitive personal information
Article 28 Sensitive personal information is personal information that is once leaked or illegally used, which can easily lead to the infringement of the personal dignity of a natural person or the personal and property safety of personal and property, including information such as biometrics, religious beliefs, specific identities, medical health, financial accounts, whereabouts, etc., as well as personal information of minors under the age of fourteen.
Only when there are specific purposes and sufficient necessity, and strict protection measures are taken, can the personal information processor process sensitive personal information.
Article 29 The processing of sensitive personal information shall obtain the individual's separate consent; if laws and administrative regulations stipulate that written consent shall be obtained for the processing of sensitive personal information, the provisions shall follow.
Article 30 If a personal information processor processes sensitive personal information, in addition to the matters stipulated in the first paragraph of Article 17 of this Law, it shall also inform the individual of the necessity of processing sensitive personal information and its impact on personal rights and interests; except where notification to individuals may not be made in accordance with the provisions of this Law.
Article 31 If a personal information processor processes personal information of a minor under the age of fourteen, it shall obtain the consent of the minor's parents or other guardians.
If a personal information processor processes personal information of minors under the age of fourteen, special personal information processing rules shall be formulated.
Article 32 If laws and administrative regulations require relevant administrative licenses or other restrictions on the processing of sensitive personal information, the provisions shall follow.
Section 3 Special provisions on handling personal information of state organs
Article 33 The activities of state organs to handle personal information shall be subject to this Law; if there are special provisions in this section, the provisions of this section shall apply.
Article 34 In order to perform statutory duties, state organs shall handle personal information in accordance with the authority and procedures stipulated by laws and administrative regulations, and shall not exceed the scope and limits necessary for performing statutory duties.
Article 35 In order to perform statutory duties, state organs shall perform their notification obligations in accordance with the provisions of this Law; unless there are circumstances stipulated in the first paragraph of Article 18 of this Law, or if notifications will hinder state organs from performing their statutory duties.
Article 36 Personal information processed by state organs shall be stored within the territory of the People's Republic of China; if it is indeed necessary to provide it abroad, a security assessment shall be conducted. Safety assessments may require support and assistance from relevant departments.
Article 37 Organizations authorized by laws and regulations with the functions of managing public affairs shall apply to the provisions of this Law on the processing of personal information by state organs in order to perform their statutory duties.
Chapter 3 Rules for cross-border provision of personal information
Article 38 If a personal information processor really needs to provide personal information outside the People's Republic of China for business needs, it must meet one of the following conditions:
(I) In accordance with the 40th section of this Law The provisions of the article pass the security assessment organized by the national Internet Information Department;
(II) Personal information protection and certification is carried out by professional institutions in accordance with the provisions of the national Internet Information Department;
(II) Conclude a contract with overseas recipients in accordance with the standard contract formulated by the national Internet Information Department, and stipulate the rights and obligations of both parties;
(IV) Other conditions stipulated by laws, administrative regulations or national Internet Information Department.
International Treaty concluded or participated by the People's Republic of China , and the agreement stipulates the conditions for providing personal information outside the People's Republic of China, etc., and may be implemented in accordance with their provisions.
Personal information processors shall take necessary measures to ensure that overseas recipients' activities to process personal information meet the personal information protection standards stipulated in this Law.
Article 39 If a personal information processor provides personal information outside the People's Republic of China, he shall inform the individual of the name or name of the overseas recipient, contact information, purpose of processing, method of processing, type of personal information, and the methods and procedures for the individual to exercise the rights stipulated in this Law to the overseas recipient, and obtain the individual's separate consent.
Article 40 Key information infrastructure operators and personal information processors who have reached the number specified by the national Internet Information Department shall store the personal information collected and generated within the territory of the People's Republic of China in the territory. If it is really necessary to provide it to overseas, it shall pass the security assessment organized by the national Internet Information Department; if laws, administrative regulations and national Internet Information Department stipulate that the security assessment may not be conducted, the provisions shall follow.
Article 41 The competent authority of the People's Republic of China handles requests from foreign judicial or law enforcement agencies to provide personal information stored in the country in accordance with relevant laws and international treaties and agreements concluded or participated by the People's Republic of China, or in accordance with the principle of equality and reciprocity. Unless approved by the competent authority of the People's Republic of China, personal information processors shall not provide personal information stored in the territory of the People's Republic of China to foreign judicial or law enforcement agencies.
Article 42 If overseas organizations or individuals engage in personal information processing activities that infringe on citizens of the People's Republic of China , or endanger the national security and public interests of the People's Republic of China, the national Internet Information Department may include it in the list of restricting or prohibiting personal information provision, make an announcement, and take measures such as restricting or prohibiting the provision of personal information to them.
Article 43 If any country or region takes discriminatory prohibitions, restrictions or other similar measures against the People's Republic of China in terms of personal information protection, the People's Republic of China may take reciprocal measures against the country or region based on actual conditions.
Chapter 4 The rights of individuals in personal information processing activities
Article 44 Individuals have the right to know and decide on the processing of their personal information, and have the right to restrict or refuse others to process their personal information; unless otherwise provided by laws and administrative regulations.
Article 45 Individuals have the right to review and copy their personal information from the personal information processor; except where there are circumstances stipulated in Article 18, paragraph 1 and Article 35 of this Law.
If a person requests to review or copy his personal information, the personal information processor shall provide it in a timely manner.
If a person requests to transfer personal information to his or her designated personal information processor and meets the conditions stipulated by the national Internet Information Department, the personal information processor shall provide a way to transfer.
Article 46 If an individual finds that his personal information is inaccurate or incomplete, he has the right to request the personal information processor to correct and supplement it.
If a person requests to correct or supplement his personal information, the personal information processor shall verify his personal information and correct and supplement it in a timely manner.
Article 47 If any of the following circumstances occurs, the personal information processor shall actively delete the personal information; if the personal information processor has not deleted, the individual has the right to request deletion:
(I) The processing purpose has been achieved, cannot be achieved, or is no longer necessary to achieve the processing purpose;
(II) The personal information processor stops providing products or services, or the retention period has expired;
(III) The individual withdraws the consent;
(IV) The personal information processor processes personal information in violation of laws, administrative regulations or agreements;
(V) Other circumstances stipulated by laws and administrative regulations.
If the retention period stipulated by laws and administrative regulations has not expired, or if the deletion of personal information is technically difficult to achieve, the personal information processor shall stop processing other than storing and taking necessary security protection measures.
Article 48 Individuals have the right to require personal information processors to explain their personal information processing rules.
Article 49 If a natural person dies, his close relatives may exercise the rights of review, copying, correcting, deleting, etc. on the relevant personal information of the deceased for his own legal and legitimate interests; unless otherwise arranged by the deceased before his death.
Article 50 Personal information processors shall establish a convenient application acceptance and processing mechanism for personal exercise of rights. If an individual refuses a request to exercise his rights, the reasons shall be explained.
If a personal information processor refuses an individual's request to exercise his rights, the individual may file a lawsuit with the people's court in accordance with the law.
Chapter 5 Obligations of personal information processors
Article 51 Personal information processors shall take the following measures to ensure that personal information processing activities comply with the provisions of laws and administrative regulations based on the purpose of the processing of personal information, the processing method, the type of personal information, the impact on personal rights and interests, possible security risks, etc., and prevent unauthorized access and personal information leakage, tampering, and loss:
(I) formulate internal Management system and operating procedures;
(II) Classified management of personal information;
(II) Take corresponding encryption, de-identification and other security technical measures ;
(IV) Reasonably determine the operational authority for personal information processing, and regularly conduct security education and training for practitioners;
(V) Formulate and organize the implementation of emergency plans for personal information security incidents;
(V) Other measures stipulated by laws and administrative regulations.
Article 52 Personal information processors whose personal information reaches the number specified by the national Internet Information Department shall designate a person in charge of personal information protection and be responsible for supervising personal information processing activities and the protection measures taken.
Personal information processors shall disclose the contact information of the person in charge of personal information protection, and submit the name and contact information of the person in charge of personal information protection to the department that performs personal information protection responsibilities.
Article 53 Personal information processors outside the territory of the People's Republic of China as stipulated in Article 3, paragraph 2 of this Law shall establish a special agency or designated representative within the territory of the People's Republic of China to handle matters related to personal information protection, and submit the names of the relevant institutions or representatives, contact information, etc. to the departments that perform personal information protection duties.
Article 54 Personal information processors shall conduct a compliance audit of their compliance with laws and administrative regulations in their processing of personal information.
Article 55 If any of the following circumstances occurs, the personal information processor shall conduct an assessment of the impact of personal information protection and record the processing situation:
(I) Processing sensitive personal information;
(II) Use personal information to make automated decisions;
(III) Entrust the processing of personal information, provide personal information to other personal information processors, and disclose personal information;
(IV) Provide personal information abroad;
(V) Other personal information processing activities that have a significant impact on personal rights and interests.
Article 56 The impact assessment of personal information protection shall include the following contents:
(I) Whether the purpose and method of processing of personal information are legal, legitimate and necessary;
(II) The impact on personal rights and interests and security risks;
(III) Whether the protection measures taken are legal, effective and are in line with the degree of risk.
Personal information protection impact assessment report and processing records shall be kept for at least three years.
Article 57 If personal information is leaked, tampered or lost, the personal information processor shall immediately take remedial measures and notify the departments and individuals that perform their personal information protection duties. The notice shall include the following matters:
(I) The types, causes and possible harms that occur or may occur in personal information leakage, tampering, or loss;
(II) Remedial measures taken by the personal information processor and measures that individuals may take to mitigate the harm;
(III) Contact information of the personal information processor.
If the personal information processor takes measures to effectively avoid the harm caused by information leakage, tampering, or loss, the personal information processor may not notify the individual; if the department that performs the personal information protection duties believe that it may cause harm, it has the right to ask the personal information processor to notify the individual.
Article 58 Personal information processors who provide important Internet platform services, huge number of users and complex business types shall fulfill the following obligations:
(I) Establish and improve a compliance system for personal information protection in accordance with national regulations, and establish an independent organization mainly composed of external members to supervise the protection of personal information;
(II) Follow the principles of openness, fairness and justice, formulate platform rules, and clarify the regulations on processing personal information by products or service providers on the platform and the obligation to protect personal information;
(II) Stop providing services to products or service providers on the platform that seriously violate laws and administrative regulations to handle personal information;
(IV) Regularly publish social responsibility reports on personal information protection and accept social supervision.
Article 59 The trustee who accepts the entrustment to process personal information shall take necessary measures to ensure the security of the personal information processed in accordance with the provisions of this Law and relevant laws and administrative regulations, and assist the personal information processor in fulfilling the obligations stipulated in this Law.
Chapter 6 Departments that perform personal information protection responsibilities
Article 60 The State Internet Information Department is responsible for coordinating the protection of personal information and related supervision and management. Relevant departments of the State Council shall be responsible for the protection and supervision and management of personal information within their respective responsibilities in accordance with the provisions of this Law and relevant laws and administrative regulations.
The personal information protection and supervision and management responsibilities of relevant departments of local people's governments at or above the county level shall be determined in accordance with relevant national regulations. The departments specified in the first two paragraphs of
are collectively referred to as departments that perform personal information protection responsibilities.
Article 61 The department that performs the duties of personal information protection performs the following personal information protection responsibilities:
(I) Carry out personal information protection publicity and education, guide and supervise personal information processors to carry out personal information protection work;
(II) Accept and handle complaints and reports related to personal information protection;
(III) Organize the evaluation of personal information protection such as applications and publish the evaluation results;
(IV) Investigate and handle illegal personal information processing activities;
(V) Other responsibilities stipulated by laws and administrative regulations.
Article 62 The State Internet Information Department coordinates relevant departments to promote the following personal information protection work in accordance with this Law:
(I) Formulate specific rules and standards for personal information protection;
(II) Formulate special personal information for small personal information processors, processing sensitive personal information, face recognition, artificial intelligence and other new technologies and new applications, and formulate special personal information. Information protection rules and standards;
(III) Support the research, development and promotion of the application of safe and convenient electronic identity authentication technology, and promote the construction of public services for network identity authentication;
(IV) Promote the construction of the social service system for personal information protection , and support relevant institutions to carry out personal information protection assessment and certification services;
(V) Improve the personal information protection complaint and reporting work mechanism.
Article 63 The department that performs personal information protection duties may take the following measures:
(I) Ask relevant parties and investigate situations related to personal information processing activities;
(II) Check and copy contracts, records, books and other related
(III) Carry out on-site inspections to investigate suspected illegal personal information processing activities;
(IV) Check equipment and items related to personal information processing activities; for equipment and items that have evidence to prove that they are used for illegal personal information processing activities, they can be sealed or seized with approval.
The departments that perform personal information protection duties perform their duties in accordance with the law, and the parties shall assist and cooperate and shall not refuse or obstruct.
Article 64 If the department that performs personal information protection duties finds that there are major risks in the personal information processing activities or personal information security incidents occur, it may interview the legal representative or the main person in charge of the personal information processor in accordance with the prescribed authority and procedures, or require the personal information processor to entrust a professional institution to conduct a compliance audit of his personal information processing activities. Personal information processors shall take measures to make rectifications and eliminate hidden dangers in accordance with the requirements.
When performing personal information protection duties, if the department that performs its duties and finds that illegal processing of personal information is suspected of committing a crime, it shall promptly transfer it to the public security organs for handling in accordance with the law.
Article 65 Any organization or individual has the right to complain or report illegal personal information processing activities to the department that performs its personal information protection duties. The department that receives complaints or reports shall handle the complaints and reports in a timely manner in accordance with the law and inform the complaints or reports of the handling results.
The department that performs personal information protection duties shall publish the contact information for accepting complaints and reports.
Chapter 7 Legal liability
Article 66 If a person processes personal information in violation of the provisions of this Law, or processes personal information without performing the personal information protection obligations stipulated in this Law, the department that performs the personal information protection duties shall order the correction, give a warning, confiscate the illegal gains, and order the application that illegally handles personal information to suspend or terminate the provision of services; if the correction is refused, a fine of not more than RMB 1 million; and a fine of not more than RMB 100,000 is imposed on the directly responsible supervisor and other directly responsible persons.
has any illegal acts stipulated in the preceding paragraph and the circumstances are serious, the department at or above the provincial level that performs personal information protection duties shall be ordered to correct the violation, confiscate the illegal gains, and impose a fine of less than 50 million yuan or less than 5% of the turnover of the previous year. It may also be ordered to suspend relevant business or suspend business and rectify, inform the relevant competent departments to revoke the relevant business license or to revoke the business license ; the directly responsible supervisors and other directly responsible persons shall be fined not less than 100,000 yuan and not more than 1 million yuan, and it may be decided to prohibit them from serving as directors, supervisors, senior management personnel and person in charge of personal information protection of the relevant enterprises within a certain period of time.
Article 67 If there are any illegal acts stipulated in this Law, they shall be recorded in the credit file in accordance with the provisions of relevant laws and administrative regulations and shall be made public.
Article 68 If a state organ fails to perform the personal information protection obligations stipulated in this Law, its superior authority or the department that performs personal information protection duties shall order it to correct the problem; the directly responsible supervisors and other directly responsible persons shall be punished in accordance with the law.
If the staff of the department that performs personal information protection duties neglect their duties, abuse their power, and commit favoritism and fraud, and does not constitute a crime, they shall be punished in accordance with the law.
Article 69 If the processing of personal information infringes on personal information rights and interests, and causes damage, and the personal information processor cannot prove that he is not at fault, he shall bear tort liability such as damage compensation.
The liability for compensation stipulated in the preceding paragraph is determined based on the losses suffered by the individual or the benefits obtained by the personal information processor; if the losses suffered by the individual and the benefits obtained by the personal information processor are difficult to determine, the amount of compensation shall be determined based on the actual situation.
Article 70 If a personal information processor processes personal information in violation of the provisions of this Law and infringes on the rights and interests of many people, the People's Procuratorate, consumer organizations stipulated by the law and organizations determined by the State Internet Information Department may file a lawsuit with the People's Court in accordance with the law.
Article 71 If a violation of the provisions of this Law and constitutes a violation of public security management, public security management punishment will be given in accordance with the law; if a crime is constituted, criminal liability shall be pursued in accordance with the law.
Chapter 8 Attachment
Article 72 If a natural person handles personal information due to personal or family affairs, this Law does not apply.
If the law has provisions on the processing of personal information in statistical and archive management activities organized and implemented by people's governments at all levels and their relevant departments, their provisions shall apply.
Article 73 The meaning of the following terms in this law:
(I) Personal information processor refers to an organization and individual who independently decides the purpose and method of processing in personal information processing activities.
(II) Automatic decision-making refers to the activities that automatically analyze and evaluate individual behavioral habits, interests, or economic, health, credit status, etc. through computer programs, and make decisions.
(III) Deidentification refers to the process in which personal information is processed so that it cannot identify a specific natural person without the help of additional information.
(IV) Anonymization refers to the process in which personal information cannot be recognized by a specific natural person and cannot be restored after processing.
Article 74 This Law shall come into force on November 1, 2021.
