D7: Privacy
This selection focuses on nationwide legislation in mainland China, covering privacy boundaries, information collection and use, retention and protection, individual rights and specific workplace settings.
Legal Provisions
Civil Code
Civil Code of the People’s Republic of China (promulgated 2020)
中华人民共和国民法典（2020年公布）
Protection of private life and privacy
English translation · Unofficial
Article 1032 Natural persons shall enjoy the right to privacy. No organisation or individual shall infringe another’s privacy through prying, intrusion, disclosure, publication or other means.
Privacy comprises the tranquillity of a natural person’s private life and private spaces, activities and information that the person does not wish others to know.
Chinese original
第一千零三十二条 自然人享有隐私权。任何组织或者个人不得以刺探、侵扰、泄露、公开等方式侵害他人的隐私权。
隐私是自然人的私人生活安宁和不愿为他人知晓的私密空间、私密活动、私密信息。
Protection of private spaces, activities and intimate body parts
English translation · Unofficial
Article 1033 Unless otherwise provided by law or expressly agreed by the rights holder, no organisation or individual shall engage in any of the following conduct:
(1) Intruding upon another person’s private life through telephone calls, text messages, instant messaging tools, emails, leaflets or other means;
(2) Entering, photographing or filming, or peering into another person’s home, hotel room or other private space;
(3) Photographing or filming, observing, eavesdropping on or disclosing another person’s private activities;
(4) Photographing or filming, or viewing, another person’s intimate body parts;
(5) Processing another person’s private information;
(6) Infringing another person’s privacy by other means.
Chinese original
第一千零三十三条 除法律另有规定或者权利人明确同意外，任何组织或者个人不得实施下列行为：
（一）以电话、短信、即时通讯工具、电子邮件、传单等方式侵扰他人的私人生活安宁；
（二）进入、拍摄、窥视他人的住宅、宾馆房间等私密空间；
（三）拍摄、窥视、窃听、公开他人的私密活动；
（四）拍摄、窥视他人身体的私密部位；
（五）处理他人的私密信息；
（六）以其他方式侵害他人的隐私权。
Labour Contract Law
Labour Contract Law of the People’s Republic of China (promulgated 2007, last amended 2012)
中华人民共和国劳动合同法（2007年公布，2012年最后修正）
Scope of information employers may seek during recruitment
English translation · Unofficial
Article 8 When recruiting a worker, an employer shall truthfully inform the worker of the work to be performed, working conditions, workplace, occupational hazards, work safety conditions, remuneration and any other matters the worker requests to know. The employer shall have the right to obtain basic information about the worker that is directly relevant to the employment contract, and the worker shall provide that information truthfully.
Chinese original
第八条 用人单位招用劳动者时，应当如实告知劳动者工作内容、工作条件、工作地点、职业危害、安全生产状况、劳动报酬，以及劳动者要求了解的其他情况；用人单位有权了解劳动者与劳动合同直接相关的基本情况，劳动者应当如实说明。
Personal Information Protection Law
Personal Information Protection Law of the People’s Republic of China (promulgated 2021)
中华人民共和国个人信息保护法（2021年公布）
Scope of personal information and processing activities
English translation · Unofficial
Article 4 Personal information means all kinds of information recorded electronically or by other means relating to an identified or identifiable natural person, excluding anonymised information.
Processing of personal information includes its collection, storage, use, processing, transmission, provision, disclosure, deletion and other such activities.
Chinese original
第四条 个人信息是以电子或者其他方式记录的与已识别或者可识别的自然人有关的各种信息，不包括匿名化处理后的信息。
个人信息的处理包括个人信息的收集、存储、使用、加工、传输、提供、公开、删除等。
Clear purposes, direct relevance and minimum necessary collection
English translation · Unofficial
Article 6 Processing of personal information shall have a clear and reasonable purpose, be directly related to that purpose, and use the method with the least impact on individuals’ rights and interests.
Collection of personal information shall be limited to the minimum scope necessary to achieve the processing purpose; excessive collection is prohibited.
Chinese original
第六条 处理个人信息应当具有明确、合理的目的，并应当与处理目的直接相关，采取对个人权益影响最小的方式。
收集个人信息，应当限于实现处理目的的最小范围，不得过度收集个人信息。
Accuracy and completeness of personal information
English translation · Unofficial
Article 8 When processing personal information, its quality shall be ensured so as to avoid adverse effects on individuals’ rights and interests arising from inaccurate or incomplete information.
Chinese original
第八条 处理个人信息应当保证个人信息的质量，避免因个人信息不准确、不完整对个人权益造成不利影响。
Lawful grounds for processing, including necessary human resources management
English translation · Unofficial
Article 13 A personal information processor may process personal information only in one of the following circumstances:
(1) The individual’s consent has been obtained;
(2) Processing is necessary for concluding or performing a contract to which the individual is a party, or for implementing human resources management in accordance with lawfully established workplace rules and lawfully concluded collective contracts;
(3) Processing is necessary for performing statutory duties or legal obligations;
(4) Processing is necessary for responding to public health emergencies or, in an emergency, protecting natural persons’ lives, health or property;
(5) Processing is carried out within a reasonable scope for news reporting, public opinion oversight or similar activities in the public interest;
(6) Processing, within a reasonable scope and in accordance with this Law, concerns information disclosed by the individual or otherwise lawfully made public;
(7) Other circumstances prescribed by laws or administrative regulations.
Where other provisions of this Law require individual consent for processing, consent is not required in the circumstances specified in items (2) to (7) of the preceding paragraph.
Chinese original
第十三条 符合下列情形之一的，个人信息处理者方可处理个人信息：
（一）取得个人的同意；
（二）为订立、履行个人作为一方当事人的合同所必需，或者按照依法制定的劳动规章制度和依法签订的集体合同实施人力资源管理所必需；
（三）为履行法定职责或者法定义务所必需；
（四）为应对突发公共卫生事件，或者紧急情况下为保护自然人的生命健康和财产安全所必需；
（五）为公共利益实施新闻报道、舆论监督等行为，在合理的范围内处理个人信息；
（六）依照本法规定在合理的范围内处理个人自行公开或者其他已经合法公开的个人信息；
（七）法律、行政法规规定的其他情形。
依照本法其他有关规定，处理个人信息应当取得个人同意，但是有前款第二项至第七项规定情形的，不需取得个人同意。
Informed and voluntary consent and renewed consent for changes
English translation · Unofficial
Article 14 Where processing is based on individual consent, that consent shall be given voluntarily and expressly on a fully informed basis. Where laws or administrative regulations require separate or written consent, those provisions shall apply.
Where the processing purpose, method or categories of personal information processed change, the individual’s consent shall be obtained again.
Chinese original
第十四条 基于个人同意处理个人信息的，该同意应当由个人在充分知情的前提下自愿、明确作出。法律、行政法规规定处理个人信息应当取得个人单独同意或者书面同意的，从其规定。
个人信息的处理目的、处理方式和处理的个人信息种类发生变更的，应当重新取得个人同意。
Right to withdraw consent
English translation · Unofficial
Article 15 Where processing is based on individual consent, individuals shall have the right to withdraw their consent. Personal information processors shall provide a convenient means of withdrawal.
Withdrawal shall not affect the validity of processing already carried out on the basis of consent before it was withdrawn.
Chinese original
第十五条 基于个人同意处理个人信息的，个人有权撤回其同意。个人信息处理者应当提供便捷的撤回同意的方式。
个人撤回同意，不影响撤回前基于个人同意已进行的个人信息处理活动的效力。
Clear prior notification and accessible processing rules
English translation · Unofficial
Article 17 Before processing personal information, a personal information processor shall, prominently and in clear, understandable language, truthfully, accurately and fully inform the individual of:
(1) The processor’s name and contact details;
(2) The processing purposes and methods, the categories of personal information processed and the retention period;
(3) The methods and procedures for exercising the rights provided by this Law;
(4) Other matters for which notification is required by laws or administrative regulations.
Where any of the above matters change, the individual shall be informed of the changes.
Where the processor provides the information required by the first paragraph through personal information processing rules, those rules shall be made public and easy to consult and retain.
Chinese original
第十七条 个人信息处理者在处理个人信息前，应当以显著方式、清晰易懂的语言真实、准确、完整地向个人告知下列事项：
（一）个人信息处理者的名称或者姓名和联系方式；
（二）个人信息的处理目的、处理方式，处理的个人信息种类、保存期限；
（三）个人行使本法规定权利的方式和程序；
（四）法律、行政法规规定应当告知的其他事项。
前款规定事项发生变更的，应当将变更部分告知个人。
个人信息处理者通过制定个人信息处理规则的方式告知第一款规定事项的，处理规则应当公开，并且便于查阅和保存。
Shortest necessary retention period
English translation · Unofficial
Article 19 Unless otherwise provided by laws or administrative regulations, personal information shall be retained for the shortest period necessary to achieve the processing purpose.
Chinese original
第十九条 除法律、行政法规另有规定外，个人信息的保存期限应当为实现处理目的所必要的最短时间。
Agreements, supervision and return or deletion in entrusted processing
English translation · Unofficial
Article 21 Where a personal information processor entrusts another party with processing personal information, it shall agree with that party on the purpose, duration and method of processing, the categories of information, protective measures, the rights and obligations of both parties and other relevant matters, and shall supervise the entrusted party’s processing activities.
The entrusted party shall process information in accordance with the agreement and shall not exceed the agreed purposes, methods or other terms. Where the entrustment contract does not take effect, is invalid, is revoked or is terminated, the entrusted party shall return the information to the personal information processor or delete it, and shall not retain it.
Without the personal information processor’s consent, the entrusted party shall not further entrust another party with processing the information.
Chinese original
第二十一条 个人信息处理者委托处理个人信息的，应当与受托人约定委托处理的目的、期限、处理方式、个人信息的种类、保护措施以及双方的权利和义务等，并对受托人的个人信息处理活动进行监督。
受托人应当按照约定处理个人信息，不得超出约定的处理目的、处理方式等处理个人信息；委托合同不生效、无效、被撤销或者终止的，受托人应当将个人信息返还个人信息处理者或者予以删除，不得保留。
未经个人信息处理者同意，受托人不得转委托他人处理个人信息。
Fair automated decisions and rights to explanation and refusal
English translation · Unofficial
Article 24 Personal information processors using personal information for automated decision-making shall ensure transparency and fair and impartial outcomes, and shall not impose unreasonable differential treatment in transaction prices or other transaction conditions.
Where information feeds or commercial marketing are delivered through automated decision-making, an option not targeted to the individual’s personal characteristics or a convenient means of refusal shall also be provided.
Where automated decision-making produces decisions significantly affecting an individual’s rights and interests, the individual shall have the right to request an explanation from the processor and to refuse decisions made solely through automated decision-making.
Chinese original
第二十四条 个人信息处理者利用个人信息进行自动化决策，应当保证决策的透明度和结果公平、公正，不得对个人在交易价格等交易条件上实行不合理的差别待遇。
通过自动化决策方式向个人进行信息推送、商业营销，应当同时提供不针对其个人特征的选项，或者向个人提供便捷的拒绝方式。
通过自动化决策方式作出对个人权益有重大影响的决定，个人有权要求个人信息处理者予以说明，并有权拒绝个人信息处理者仅通过自动化决策的方式作出决定。
Scope and strict protection of sensitive personal information
English translation · Unofficial
Article 28 Sensitive personal information means personal information which, if disclosed or unlawfully used, could readily infringe a natural person’s dignity or endanger personal or property safety. It includes biometric information, religious beliefs, specific identity information, medical and health information, financial accounts, location and movement information, and the personal information of minors under 14 years of age.
Personal information processors may process sensitive personal information only where there is a specific purpose and sufficient necessity and strict protective measures are taken.
Chinese original
第二十八条 敏感个人信息是一旦泄露或者非法使用，容易导致自然人的人格尊严受到侵害或者人身、财产安全受到危害的个人信息，包括生物识别、宗教信仰、特定身份、医疗健康、金融账户、行踪轨迹等信息，以及不满十四周岁未成年人的个人信息。
只有在具有特定的目的和充分的必要性，并采取严格保护措施的情形下，个人信息处理者方可处理敏感个人信息。
Rights to know, decide, restrict and refuse
English translation · Unofficial
Article 44 Individuals shall have the rights to know about and decide on the processing of their personal information and to restrict or refuse its processing by others, except where laws or administrative regulations provide otherwise.
Chinese original
第四十四条 个人对其个人信息的处理享有知情权、决定权，有权限制或者拒绝他人对其个人信息进行处理；法律、行政法规另有规定的除外。
Access, copies and qualifying transfers of personal information
English translation · Unofficial
Article 45 Individuals shall have the right to access and obtain copies of their personal information from personal information processors, except in the circumstances specified in the first paragraph of Article 18 or in Article 35 of this Law.
Where an individual requests access or copies, the processor shall provide them promptly.
Where an individual requests transfer of their information to a designated personal information processor and the conditions prescribed by the national cyberspace authority are met, the processor shall provide a means for the transfer.
Chinese original
第四十五条 个人有权向个人信息处理者查阅、复制其个人信息；有本法第十八条第一款、第三十五条规定情形的除外。
个人请求查阅、复制其个人信息的，个人信息处理者应当及时提供。
个人请求将个人信息转移至其指定的个人信息处理者，符合国家网信部门规定条件的，个人信息处理者应当提供转移的途径。
Correction and completion of inaccurate or incomplete information
English translation · Unofficial
Article 46 Individuals who find that their personal information is inaccurate or incomplete shall have the right to request that the personal information processor correct or supplement it.
Upon receiving such a request, the processor shall verify the information and promptly correct or supplement it.
Chinese original
第四十六条 个人发现其个人信息不准确或者不完整的，有权请求个人信息处理者更正、补充。
个人请求更正、补充其个人信息的，个人信息处理者应当对其个人信息予以核实，并及时更正、补充。
Deletion requirements and exceptions for statutory retention
English translation · Unofficial
Article 47 A personal information processor shall proactively delete personal information in any of the following circumstances; if it fails to do so, the individual shall have the right to request deletion:
(1) The processing purpose has been achieved, cannot be achieved or no longer requires the information;
(2) The processor ceases to provide products or services, or the retention period expires;
(3) The individual withdraws consent;
(4) The processor processes the information in violation of laws, administrative regulations or the agreement;
(5) Other circumstances prescribed by laws or administrative regulations.
Where a retention period prescribed by laws or administrative regulations has not expired, or deletion is technically difficult, the processor shall cease processing other than storage and the implementation of necessary security measures.
Chinese original
第四十七条 有下列情形之一的，个人信息处理者应当主动删除个人信息；个人信息处理者未删除的，个人有权请求删除：
（一）处理目的已实现、无法实现或者为实现处理目的不再必要；
（二）个人信息处理者停止提供产品或者服务，或者保存期限已届满；
（三）个人撤回同意；
（四）个人信息处理者违反法律、行政法规或者违反约定处理个人信息；
（五）法律、行政法规规定的其他情形。
法律、行政法规规定的保存期限未届满，或者删除个人信息从技术上难以实现的，个人信息处理者应当停止除存储和采取必要的安全保护措施之外的处理。
Right to an explanation of processing rules
English translation · Unofficial
Article 48 Individuals shall have the right to request that personal information processors explain their personal information processing rules.
Chinese original
第四十八条 个人有权要求个人信息处理者对其个人信息处理规则进行解释说明。
Accessible rights-request mechanisms and remedies
English translation · Unofficial
Article 50 Personal information processors shall establish convenient mechanisms for receiving and handling individuals’ requests to exercise their rights. Where a request is refused, the reasons shall be explained.
Where a personal information processor refuses a request to exercise rights, the individual may bring proceedings before a people’s court in accordance with the law.
Chinese original
第五十条 个人信息处理者应当建立便捷的个人行使权利的申请受理和处理机制。拒绝个人行使权利的请求的，应当说明理由。
个人信息处理者拒绝个人行使权利的请求的，个人可以依法向人民法院提起诉讼。
Internal procedures, access controls, training and security measures
English translation · Unofficial
Article 51 Personal information processors shall, taking account of processing purposes and methods, the categories of information, the impact on individuals’ rights and interests, potential security risks and other relevant factors, take the following measures to ensure compliance with laws and administrative regulations and prevent unauthorised access, disclosure, alteration or loss:
(1) Establish internal management systems and operating procedures;
(2) Apply classification-based management to personal information;
(3) Adopt appropriate security technologies, including encryption and de-identification;
(4) Reasonably determine operational permissions for processing and regularly provide personnel with security education and training;
(5) Develop and organise implementation of personal information security incident response plans;
(6) Other measures prescribed by laws or administrative regulations.
Chinese original
第五十一条 个人信息处理者应当根据个人信息的处理目的、处理方式、个人信息的种类以及对个人权益的影响、可能存在的安全风险等，采取下列措施确保个人信息处理活动符合法律、行政法规的规定，并防止未经授权的访问以及个人信息泄露、篡改、丢失：
（一）制定内部管理制度和操作规程；
（二）对个人信息实行分类管理；
（三）采取相应的加密、去标识化等安全技术措施；
（四）合理确定个人信息处理的操作权限，并定期对从业人员进行安全教育和培训；
（五）制定并组织实施个人信息安全事件应急预案；
（六）法律、行政法规规定的其他措施。
Regular personal information compliance audits
English translation · Unofficial
Article 54 Personal information processors shall regularly conduct compliance audits of whether their processing of personal information complies with laws and administrative regulations.
Chinese original
第五十四条 个人信息处理者应当定期对其处理个人信息遵守法律、行政法规的情况进行合规审计。
Circumstances requiring a prior personal information protection impact assessment
English translation · Unofficial
Article 55 In any of the following circumstances, personal information processors shall carry out a personal information protection impact assessment in advance and keep records of the processing:
(1) Processing sensitive personal information;
(2) Using personal information for automated decision-making;
(3) Entrusting processing to another party, providing information to other personal information processors or disclosing it publicly;
(4) Providing personal information outside the country;
(5) Other processing activities significantly affecting individuals’ rights and interests.
Chinese original
第五十五条 有下列情形之一的，个人信息处理者应当事前进行个人信息保护影响评估，并对处理情况进行记录：
（一）处理敏感个人信息；
（二）利用个人信息进行自动化决策；
（三）委托处理个人信息、向其他个人信息处理者提供个人信息、公开个人信息；
（四）向境外提供个人信息；
（五）其他对个人权益有重大影响的个人信息处理活动。
Provisions on Employment Services and Employment Management
Ministry of Labour and Social Security Order No. 28, Provisions on Employment Services and Employment Management (promulgated 2007, last revised 2022)
劳动和社会保障部令第28号，就业服务与就业管理规定（2007年公布，2022年最后修订）
Confidentiality of worker information and use of technical and intellectual achievements
English translation · Unofficial
Article 13 Employers shall keep workers’ personal information confidential. Public disclosure of a worker’s personal information and use of the worker’s technical or intellectual achievements shall require the worker’s written consent.
Chinese original
第十三条 用人单位应当对劳动者的个人资料予以保密。公开劳动者的个人资料信息和使用劳动者的技术、智力成果，须经劳动者本人书面同意。
Measures for the Security Management of Facial Recognition Technology Applications
Cyberspace Administration of China and Ministry of Public Security Order No. 19, Measures for the Security Management of Facial Recognition Technology Applications (promulgated 2025)
国家互联网信息办公室、中华人民共和国公安部令第19号，人脸识别技术应用安全管理办法（2025年公布）
Necessity and minimum impact in facial information processing
English translation · Unofficial
Article 4 The use of facial recognition technology to process facial information shall have a specific purpose and sufficient necessity, use the method with the least impact on individuals’ rights and interests, and implement strict protective measures.
Chinese original
第四条 应用人脸识别技术处理人脸信息，应当具有特定的目的和充分的必要性，采取对个人权益影响最小的方式，并实施严格保护措施。
Alternative verification methods where equivalent non-facial options exist
English translation · Unofficial
Article 10 Where other methods not using facial recognition technology can achieve the same purpose or meet equivalent business requirements, facial recognition technology shall not be used as the sole verification method. Where an individual does not agree to identity verification through facial information, other reasonable and convenient methods shall be provided.
Where the State provides otherwise for the use of facial recognition technology to verify identity, those provisions shall apply.
Chinese original
第十条 实现相同目的或者达到同等业务要求，存在其他非人脸识别技术方式的，不得将人脸识别技术作为唯一验证方式。个人不同意通过人脸信息进行身份验证的，应当提供其他合理、便捷的方式。
国家对应用人脸识别技术验证个人身份另有规定的，从其规定。
Mapping Gap
Scope
Many requirements in this topic have direct or substantial legal counterparts. This analysis focuses on boundaries of application and matters requiring further assessment; not every difference indicates a gap in legal protection.
D7.1 — Privacy extends beyond databases to private spaces at work.
Privacy protection under the Civil Code covers private life, private spaces, private activities and private information. A D7 assessment should therefore extend beyond personnel files and electronic systems to matters such as dormitory inspections, surveillance, private communications and bodily privacy.
Company ownership of premises or equipment does not automatically remove privacy protection. Equally, not every management inspection is unlawful. The nature of the space, purpose, legal basis, methods and degree of intrusion require assessment.
D7.2(a)–(c) and D7.4 — Consent is neither the only lawful ground nor unrestricted authorisation.
Chinese law permits processing on grounds other than consent, including necessary human-resources administration, contractual necessity and legal obligations, where the statutory conditions are met. D7.4 should not be read as an unconditional right to refuse every legally necessary processing activity.
Conversely, a general claim of “HR needs” or a blanket consent form does not remove purpose limitation, data minimisation or security duties. Consent-based processing remains subject to informed and voluntary agreement, renewed consent where required, and accessible withdrawal mechanisms.
D7.2(b), (d) and (e) — Original purposes and the use of information in employment decisions.
Chinese law requires clear, necessary and relevant processing purposes and regulates changes to consent-based processing. This is not identical to D7.2(b)’s original-purpose wording: establishing a lawful basis for a new purpose does not automatically demonstrate conformity with that requirement.
The selected provisions do not set a universal numerical limit on data used in hiring, promotion or termination. Necessity, accuracy, role relevance and discriminatory effects must be assessed. Where automated decisions significantly affect individuals, explanation rights and the right to reject decisions made solely through automation also apply. The anti-discrimination provisions mapped under D5 remain relevant.
D7.3(a)–(d) and D7.4 — Minimum retention does not mean immediate deletion on departure.
Accuracy, minimisation, security and the shortest necessary retention period have direct legal counterparts. Retention must nevertheless be determined by record category and purpose. Neither permanent retention of all personnel records nor automatic deletion of all records upon departure is appropriate.
Records subject to continuing legal retention requirements must be retained within the necessary scope, with further processing restricted as applicable. Access, correction and deletion rights are also subject to statutory conditions; unconditional immediate deletion should not be promised.
D7.3(e) — Protection of intellectual outputs does not determine ownership.
Article 13 of the Provisions on Employment Services and Employment Management expressly addresses the use of workers’ technical and intellectual achievements and provides a relevant legal connection.
However, its recruitment context does not establish that every work product belongs personally to the worker or that all employer use follows an identical rule. Ownership and use of works, inventions and other outputs require assessment under the applicable intellectual-property laws, employee-created output rules and valid agreements. A complete intellectual-property mapping is outside this selection.
D7.3(f) and D7.4 — Sensitive information and vulnerable populations are distinct concepts.
Chinese law provides heightened protection for sensitive information, including biometrics, health and religious information, as well as information concerning children under 14. This supplies a clear basis for identifying high-risk data.
However, statutory sensitive-data categories are not a substitute for assessing vulnerable populations under D7.3(f). Literacy or language barriers, disability and dependency on an employer may affect people’s ability to understand notices, express preferences and exercise rights. These circumstances require contextual assessment and may overlap with D5’s inclusion requirements.
D7.4 — Awareness of a policy is not the same as understanding and exercising rights.
Clear and understandable notices, accessible rules and convenient rights-request mechanisms provide strong legal correspondence with D7.4.
A signed acknowledgement alone does not establish practical understanding. Assessment should consider whether workers know the purposes, retention periods, contact channels and procedures for exercising their rights, and whether requests are actually handled. Individuals may also request explanations of processing rules.
D7.2, D7.3 and D7.4 — Facial recognition for access control and attendance.
Convenience alone does not justify unrestricted use of facial recognition for access control or attendance. Where the Measures apply, a specific purpose, sufficient necessity and protective measures must be established. Facial recognition must not be the sole verification method where non-facial alternatives achieve the same purpose or equivalent business requirements; the alternative-method requirements and statutory exceptions in Article 10 must be observed.
These are specific domestic obligations, and conformity with D7’s general principles alone does not establish compliance.
D7.3(c) and D7.5 — Outsourcing, audit evidence and overseas disclosures require classification.
Outsourcing employee-data processing does not transfer away the employer’s responsibilities merely because a confidentiality agreement exists. Where the arrangement constitutes entrusted processing, scope, supervision and return or deletion requirements apply.
Disclosures to auditors, customers or overseas headquarters must be classified according to the actual purposes and decision-making roles. Entrusted processing, disclosure to another personal information processor and cross-border transfers require different assessments. D7 does not authorise unrestricted disclosure of workers’ identity, payroll or health records to customers.
D7.5 — Domestic law already imposes substantive governance duties.
Chinese law already imposes substantive governance duties, including internal procedures, classification, access controls, training, incident planning, compliance audits and impact assessments in specified circumstances. It would therefore be inaccurate to mark D7’s management-system requirements as having no legal counterpart.
These duties are not identical to the structure and coverage of M1–M10. Worker and stakeholder involvement, organisational objectives and continual improvement still require separate assessment. A personal-information compliance audit is also not equivalent to a social audit.