China Data Protection Rules

Home | China Law Blog | China Data Protection Rules Table of Contents Toggle Earlier this year, China released the final version of the national standard on personal information protection, GB/T 35273-2017 Information Technology – Personal Information Security Specification (信息安全技术 个人信息安全规范) (the “Specification”). The Specification will take effect on May 1, 2018. The Specification is not a law or regulation that requires mandatory compliance. However, it likely will be relied on by Chinese government agencies as a standard to determine whether companies are following China’s data protection rules. Businesses that collect or process personal information in China should check their current practices against this Specification to identify and minimize their potential risks. The below provides the basics on this new Specification. Personal Information and Sensitive Personal Information Under the Cybersecurity Law of China, personal information means information that can be used to identify a person if used separately or in combination with other information. This new Specification expands this definition to include information that reflects a person’s activities, such as browsing history. Sensitive personal information includes information that, if leaked, illegally provided, or used inappropriately, will likely threaten personal and property safety and can easily harm personal reputation, physical or mental health or lead to discriminatory treatment. Examples of sensitive personal information include a person’s ID card number, bank account number, and personal information of minors of age 14 or younger. Data Controller The new Specification introduces the concept of a personal data controller, which means a natural person or an organization that determines the purposes and means for processing personal data. A data controller is responsible for complying with applicable laws and regulations in the collection, retention, use, sharing and transfer of personal information, as well as in handling data breaches. Data Collection The new Specification states that collecting personal data should be done legally and minimally. It requires a data controller obtain consent the person whose data is being collected, and it further requires explicit consent when sensitive data is being collected. There are a few exceptions when consent is not required. For example, when the collection and use of personal data is necessary for executing and performing contracts, for criminal investigation, or for news reports when the data controller is a news agency. A data controller shall also establish and publish a privacy policy according to the Specification. A model privacy policy is also attached to the Specification. Data Retention Personal information must be retained for the shortest period of time and only to the extent necessary. After personal information has been collected, the data controller must de-identify such information and retain the de-identified information separate from any personal identifiable information. When a data controller ceases operations, it must stop collecting personal information, inform relevant data subjects of the same, and delete or anonymize all of the personal information it has retained. Use of Data A data controller must limit access to collected personal information to the minimum extent necessary. Data subjects have the right to access data and to rectify incorrect or incomplete data, the right to erasure and to data portability, as well as the right of account cancellation Third-Party Processors; Sharing and Transfer of Data When a data controller outsources data processing to a third party, the data controller must conduct a security assessment to ensure the third-party processor is capable of offering sufficient security. The data controller must also supervise the processor by audits and by imposing contractual obligations regarding data processing security. If a data controller needs to share or transfer personal information, it must first conduct a security assessment, use effective measures to safeguard data subjects, inform data subjects of the purpose and the recipient of the data transfer and obtain prior consent (a separate consent in addition to the initial consent to collecting and processing data). If a data controller is acquired by or merged with other entities, it must notify the data subjects of this fact and its successor shall continue to perform the original data controller’s responsibilities and obligations. Data Breach Incidents Data controllers must have security incident response plans in place, provide periodic training and perform emergency drills at least annually. When a data breach occurs, the data controller must record the incident, assess potential impact and take remedial measures. It shall also notify affected data subjects of the incident by email, mail, phone, push notification, or other reasonable and effective method when individual notice is not practically possible. Check Out Our China Law Services Share Twitter Facebook LinkedIn E-mail Comment Arlo Kipfer Arlo is based in Bogotá, where he advises clients on Latin America and China business issues. In addition, Arlo has advised clients on the establishment of several independent and joint venture international schools and he is a frequent speaker at international school conferences. Harris Sliwoski Attorney Read more posts [email protected] Read More China Business, Legal News Related Posts September 15, 2026 Your AI-Drafted China Contract Says It Needs a Lawyer. Listen to It. September 11, 2026 Forensic Accountants in China Business Litigation: How True Numbers Can Tell the Wrong Story September 4, 2026 China NNN Agreement or Trademark Registration? You Usually Need Both September 1, 2026 AI Didn't Replace Lawyers. It Gave Us the 48-Page Contract. August 27, 2026 Do I Need a China NNN Agreement or a China Manufacturing Agreement? Usually Both. August 26, 2026 China’s New Overseas Investment Rules: Can Your Chinese Investor Actually Get the Money Out? August 24, 2026 International IP Protection for Startups: What to Protect and Where August 19, 2026 The Documents Are the International Deal August 19, 2026 China Supplier Fraud in Yiwu: Why We Recommended the Police, Not a Lawsuit August 17, 2026 China Trademark Registration: Why U.S. Companies Need More Than a Filing Agent August 10, 2026 Buying Expensive Equipment from China: Seven Questions to Answer Before You Pay August 7, 2026 DDP Shipping Risks: What Boise Cascade’s Guilty Plea Means for U.S. Buyers August 6, 2026 Protecting Your Artwork Internationally: What Artists Need to Do Before the Work Travels August 5, 2026 Your China Employee Signed the Vacation Policy. You Can Still Lose. July 29, 2026 The RedNote Contract Lesson for Companies Doing Business in China Leave a comment Cancel reply