IAPP Certified Information Privacy Professional, China

Several bodies regulate personal information at once. You study the Cyberspace Administration, public security authorities, sector regulators and the courts, and how each investigates, inspects and enforces.

• The Cyberspace Administration of China
• The Ministry of Public Security and local public security bureaus
• Sector regulators and their rules
• Courts, public interest litigation and civil claims
• Enforcement campaigns and app inspections
• Dealing with a regulatory inquiry

You build A regulator map that shows who an organization may face for each type of data practice.

Data security obligations reach beyond personal information. You learn data classification, important data, the Multi-Level Protection Scheme, critical information infrastructure and the security duties of network operators.

• The Data Security Law and its scope
• Data classification and important data
• Critical information infrastructure operators
• The Multi-Level Protection Scheme
• Security duties of network operators
• Data security incidents and reporting

You build A data classification and MLPS readiness plan for one information system.

PIPL is China’s core personal information statute. You decide when it applies, including to overseas organizations, define personal information and sensitive personal information, and apply its principles of lawfulness, necessity and openness.

• Scope and extraterritorial reach
• Personal information, anonymization and de-identification
• Sensitive personal information and minors’ data
• Principles: lawfulness, purpose, minimum necessary, openness
• Overseas handlers and local representatives
• Applying the scope test to cases

You build A PIPL scope and data classification memo for a foreign company with Chinese users.

PIPL offers several grounds for processing, and consent is only one of them. You choose the right ground, obtain separate consent where it is required, and handle notices, withdrawal and information that people have made public.

• The legal bases for processing
• Consent: informed, voluntary and withdrawable
• When separate consent is required
• Notices and privacy policies
• Public places and image collection equipment
• Publicly disclosed information
• Choosing a basis for a real activity

You build A legal basis and consent matrix for ten processing activities.

Handlers carry heavy duties, and individuals hold real rights. You allocate roles between handlers and entrusted parties, answer rights requests, appoint protection officers, audit, and run impact assessments.

• Personal information handlers, joint handlers and entrusted parties
• Individual rights: access, copy, correction, deletion, portability
• Handling rights requests and refusals
• Protection officers and internal management systems
• Compliance audits and impact assessments
• Breach response and notification
• Large platforms as gatekeepers

You build A rights-request procedure and an impact assessment template for a Chinese service.

Moving data out of China needs a defined route. You compare the security assessment, standard contract and certification routes, apply localization rules for certain operators, and plan transfers within a corporate group.

• What counts as a cross-border transfer
• Security assessment by the Cyberspace Administration
• Standard contracts and filing
• Certification by professional institutions
• Localization for critical operators and large volumes
• Requests from foreign authorities
• Transfer impact assessments in practice

You build A cross-border transfer plan that picks a route for each data flow.

Algorithms that decide about people face specific rules, and violations carry real penalties. You apply the transparency and opt-out requirements, learn the forms of liability, and plan how to respond to a regulator.

• Automated decision-making: transparency and fairness
• Personalized recommendations and opt-out
• Fair treatment in pricing and marketing
• Administrative penalties and personal liability
• Civil liability and the burden of proof
• Criminal liability for personal information offences
• Reporting duties and regulator interviews

You build An algorithm transparency and opt-out design for a recommendation feature.

Consumer-facing products face the most scrutiny. You apply the rules on what apps may collect, on permissions, on marketing messages and targeted advertising, and on the extra protection owed to minors.

• What mobile apps may collect and ask permission for
• SDKs and third-party code in apps
• Marketing messages and targeted advertising
• Minors’ personal information and guardian consent
• Rules for children’s products and services
• App store and platform inspection

You build An app compliance review covering collection, permissions, marketing and minors.

Several sectors add their own rules on top of PIPL. You apply requirements for financial institutions, internet platforms, connected vehicles, employers, and health and genetic information, plus sensitive records such as criminal records.

• Banks and financial institutions
• Internet platforms and their gatekeeper duties
• Automotive data and connected vehicles
• Employers: recruitment, monitoring and employee data
• Health, medical and human genetic data
• Sensitive records, including criminal records

You build A sector rules checklist for a company that spans two of these industries.

One scenario joins the whole subject. You advise a company that runs an app in China with a foreign parent, decide which rules apply, design consent, transfers and rights handling, and write the opinion.

• Establishing facts, roles and scope
• Choosing legal bases and designing consent
• Planning transfers and local compliance
• Setting up rights, security and incident handling
• Writing and defending the advice

You build A written compliance opinion for a company operating an app in China.