Personal Information Protection Law of the People's Republic of China

要点解读 Key Points

中文导读

《中华人民共和国个人信息保护法》2021年8月20日通过，2021年11月1日起施行，是中国首部系统规范个人信息处理活动的法律，确立告知同意、个人权利行使和个人信息跨境提供规则。

• 域外适用（第3条）：在境外处理境内自然人个人信息，为境内自然人提供产品或服务、分析评估其行为等情形的，同样适用本法。
• 处理原则与同意（第5、6、13、14条）：合法、正当、必要、诚信，目的明确、最小范围；处理个人信息须取得个人同意，重要事项须取得单独同意。
• 个人权利（第44—47条）：知情权、决定权、查阅复制权、更正补充权、删除权（处理目的已实现、撤回同意、违法处理等情形）；已故自然人的近亲属可代行相关权利（第49条）。
• 跨境提供三条路径（第38条）：确需向境外提供的，须满足其一——通过网信部门安全评估、经专业机构个人信息保护认证、与境外接收方订立标准合同；并告知境外接收方信息、取得个人单独同意（第39条）。
• 数据本地化（第40条）：关键信息基础设施运营者和处理个人信息达到规定数量的处理者，境内收集产生的个人信息须境内存储；确需出境的须通过安全评估。
• 境外司法调取（第41条）：非经中国主管机关批准，任何组织、个人不得向外国司法或执法机构提供存储于境内的个人信息。
• 处理者义务与举证倒置（第69条）：建立内部管理制度、采取安全技术措施、定期合规审计；侵害个人信息权益的，处理者不能证明无过错的承担损害赔偿责任。
• 法律责任（第66条）：情节严重的，没收违法所得，处5000万元以下或上一年度营业额5%以下罚款，可责令停业整顿、吊销许可；直接负责人员处10万—100万元罚款，可被禁止担任董监高等职务。

English Key Points

The Personal Information Protection Law, adopted August 20, 2021 and effective November 1, 2021, is China's first comprehensive personal-information statute, establishing consent rules, individual rights, and cross-border transfer mechanisms.

• Extraterritorial reach (Art. 3): applies to overseas processing of China residents' data for offering products/services or analyzing behavior in China.
• Principles and consent (Arts. 5, 6, 13, 14): lawful, justified, necessary, good faith; clear purpose, data minimization; consent required, separate consent for major matters.
• Individual rights (Arts. 44–47): to be informed, to decide, to access/copy, to rectify, to erase (purpose fulfilled, consent withdrawn, unlawful processing); close relatives may exercise rights of the deceased (Art. 49).
• Three cross-border routes (Art. 38): security assessment by the cyberspace authority, PI protection certification, or standard contract with the overseas recipient; inform individuals and obtain separate consent (Art. 39).
• Localization (Art. 40): CII operators and large-scale processors must store China-collected PI domestically; outbound transfer requires security assessment.
• Foreign legal process (Art. 41): no providing China-stored PI to foreign judicial or law enforcement bodies without Chinese approval.
• Processor duties and reversed burden of proof (Art. 69): internal rules, security measures, audits; processors bear damages unless they prove no fault.
• Penalties (Art. 66): up to RMB 50M or 5% of prior-year turnover for serious violations, plus suspension or license revocation; responsible persons fined RMB 100K–1M and may be barred from executive roles.

本页面解读基于公开文本整理，仅供参考，不构成法律意见。具体案件请咨询执业律师。
This summary is based on the published text and is for reference only; it does not constitute legal advice. Consult a licensed attorney for your specific case.