--- title: "China — Controller/Processor Duties | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/china/controller-processor-duties/ source_html: /jurisdictions/china/controller-processor-duties/index.html description: "China — Controller/Processor Duties: controller_processor_duties Controller/Processor Duties 7 sub-modules 7 claims Amber ▾ # Core accountability, DPIA, security and breach-notification duties are enacted and enforced, bu" generated_at: 2026-10-25T04:46:50Z content_sha256: 79bbc990d310852844291aa85d281694441c16662c3ef123754d82b30096e988 generator: "fe-fleet/md-twin@1.0" --- # China — Controller/Processor Duties | Data Protection Monitor ### D4Controller/Processor Duties7 sub-modules7 claimsAmber▾# Core accountability, DPIA, security and breach-notification duties are enacted and enforced, but the PIPO appointment threshold and processor ('entrusted party') definitions remain under-specified in binding text. Primary framework PIPL Chapter V (Arts 51–59); Regulations on Network Data Security Management (eff. 1 Jan 2025) Supervisory authority [Cyberspace Administration of China (CAC)](https://www.cac.gov.cn/) Traffic-light rationale — Amber Core accountability, DPIA, security and breach-notification duties are enacted and enforced, but the PIPO appointment threshold and processor ('entrusted party') definitions remain under-specified in binding text. #### Sub-modules (7) #### Accountability And DpiaAmber PIPL lacks an express GDPR-style accountability principle but requires handlers to accept responsibility for their processing and adopt necessary safeguards; DPIAs (Art 55) are mandatory for sensitive-data processing, ADM, entrusting/sharing/disclosing PI, cross-border transfer, and other major-impact processing. Claims (1): - Under PIPL Article 55, a personal information handler must conduct a personal information protection impact assessment prior to handling sensitive personal information, using personal information for automated decision-making, entrusting/sharing/disclosing personal information, transferring personal information abroad, or engaging in other processing with a major influence on individuals; the assessment must evaluate lawfulness/necessity, impact on individuals' rights, and adequacy of protective measures. #### Dpo RequirementsAmber PIPL requires appointment of a Personal Information Protection Officer (PIPO) above an as-yet-undefined processing-volume threshold; industry guidance points to organizations processing hundreds of thousands to millions of individuals' data. Claims (1): - PIPL requires certain handlers to appoint a Personal Information Protection Officer (PIPO), but the precise processing-volume threshold triggering this requirement is not specified in the statute; analogous CAC draft measures reference thresholds around one million individuals' data. #### Ropa RequirementsAmber Unlike GDPR's blanket Art 30 requirement, PIPL imposes record-keeping only for the DPIA-triggering categories, with processing records and assessment reports retained for at least three years (Art 55). Claims (1): - Unlike GDPR's universal Article 30 record-keeping duty applicable to controllers and processors alike, PIPL imposes record-of-processing obligations on handlers only for the categories triggering a DPIA, and requires retention of impact-assessment processing records for at least three years (Art 55). #### Joint Controller ArrangementsAmber PIPL does not define 'entrusted parties' as precisely as GDPR defines processors, but imposes obligations on them, including a duty to notify and assist the handler in the event of a breach affecting entrusted data. Claims (1): - PIPL does not define 'entrusted parties' (the processor-equivalent role) as precisely as GDPR defines data processors, though it imposes obligations on such parties, including a duty to notify the handler and provide technical/administrative assistance in the event of a breach involving entrusted personal information. #### Security MeasuresGreen Handlers must adopt organizational and technical measures — internal management rules, PI classification, encryption/de-identification, access controls, periodic staff training, and incident-response mechanisms. Claims (1): - PIPL requires handlers to adopt organizational and technical measures to prevent unauthorized access, damage, leakage or loss of personal information, including internal management mechanisms, classification of personal information, encryption and de-identification, access controls, and periodic security training. #### Breach NotificationGreen Article 57 requires handlers, on any actual or possible leak, distortion or loss of PI, to take remedial measures and notify regulators and affected individuals of incident categories, causes, possible harm, remedial steps and contact details, unless harm is effectively avoided. Claims (1): - Under PIPL Article 57, whenever a leak, distortion or loss of personal information occurs or might have occurred, handlers must adopt remedial measures and notify relevant departments and affected individuals of the information categories, causes and possible harm, the remedial measures taken and steps individuals can take to mitigate harm, and a method of contact; notification to individuals is excused where the handler adopts measures effectively avoiding harm. #### Retention And DisposalGreen The 2025 Network Data Security Management Regulations require companies processing personal data of more than 10 million individuals to submit a data disposal plan to regulators in the event of a merger, acquisition, spin-off or insolvency affecting data security. Claims (1): - The Regulations on Network Data Security Management require a company processing personal data of more than 10 million individuals to establish a dedicated department and appoint a senior data-security executive, and to submit a data disposal plan to regulators upon a merger, acquisition, spin-off or insolvency affecting data security. Category narrative 100 words PIPL Chapter V imposes DPIA obligations (Arts 55–56) triggered by sensitive-data processing, automated decision-making, entrusting/sharing/public disclosure of PI, cross-border transfers, and other 'major-impact' processing; a Personal Information Protection Officer (PIPO) requirement exists but the numeric threshold remains undefined in the statute itself. Record-keeping obligations are narrower than GDPR's blanket Art 30 ROPA, applying mainly to the DPIA-triggering categories, with 3-year minimum retention of assessment records. Breach notification (Art 57) requires remedial action plus notice to regulators and affected individuals unless harm is effectively neutralized. The 2025 Network Data Security Management Regulations add data-disposal-plan obligations for very-large-scale processors upon M&A/insolvency events. Periodic update · new data 2026-10-12 #### Controller/Processor Duties Control and processor obligations in China are now visibly tiered by processor scale. For small personal information processors, those handling the personal information of fewer than 100,000 individuals, Order No. 25 establishes two operative relief measures now in force since 1 September 2026. Under Article 13, a small processor may conduct a compliance audit at least once every five years, using a simplified self-check form, the Small Personal Information Processor Compliance Audit Self-Check Form, annexed to the Provisions, and must retain the resulting audit records; this stands in place of the more frequent or more rigorous audit obligations that would otherwise apply. Under Article 12, a small processor that ceases its product or service must take necessary measures to delete the personal information it holds; where it is genuinely unable to delete that information, it may instead report the situation to the relevant competent department and request assistance, rather than being left with an unconditional deletion obligation it cannot practically meet. At the other end of the scale, the draft Large Personal Information Processor Provisions would impose a materially heavier set of duties once finalized. Article 9 of the draft requires a qualifying large processor's collection of personal information to adhere to the minimum-necessity principle, limiting collection to what is necessary to provide the product or service and prohibiting over-collection. This provision remains at the consultation stage, with the comment window having closed on 7 September 2026, and is not yet binding; it nonetheless signals the direction of the large-processor compliance architecture the regulator is developing, which the regulatory horizon tracking anticipates would additionally include internal management systems and proactive security-monitoring duties once the instrument is finalized. The practical effect of this tiering is to create two distinct compliance postures within the same statutory framework: a now-binding, simplified obligations track for small processors, and a prospective, substantially heavier obligations track for large processors that remains in active drafting. A processor's classification into one tier or the other will materially determine its present and near-future compliance burden. #### Outlook The principal development to watch is whether the draft large-processor obligations, particularly the Article 9 minimum-necessity requirement, are finalized in the form consulted upon or are revised before promulgation. Given the consultation closed on 7 September 2026 and no finalized text had appeared as of 11 October 2026, the fourth-quarter-2026 finalization estimate carries meaningful uncertainty, and large processors should not assume the consultation-stage text is final. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Evidence 7 Sources and claims (7) - Probable[IAPP](https://iapp.org/news/a/top-5-operational-impacts-chinas-pipl-part-3-personal-information-protection-officer) — Under PIPL Article 55, a personal information handler must conduct a personal information protection impact assessment prior to handling sensitive personal information, using personal information for automated decision-making, entrusting/sharing/disclosing personal information, transferring personal information abroad, or engaging in other processing with a major influence on individuals; the assessment must evaluate lawfulness/necessity, impact on individuals' rights, and adequacy of protective measures.observed 2026-08-03 - Probable[IAPP](https://iapp.org/news/a/top-5-operational-impacts-chinas-pipl-part-3-personal-information-protection-officer) — PIPL requires certain handlers to appoint a Personal Information Protection Officer (PIPO), but the precise processing-volume threshold triggering this requirement is not specified in the statute; analogous CAC draft measures reference thresholds around one million individuals' data.observed 2026-08-03 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v_pipl_.pdf) — Unlike GDPR's universal Article 30 record-keeping duty applicable to controllers and processors alike, PIPL imposes record-of-processing obligations on handlers only for the categories triggering a DPIA, and requires retention of impact-assessment processing records for at least three years (Art 55).observed 2026-08-03 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v_pipl_.pdf) — PIPL does not define 'entrusted parties' (the processor-equivalent role) as precisely as GDPR defines data processors, though it imposes obligations on such parties, including a duty to notify the handler and provide technical/administrative assistance in the event of a breach involving entrusted personal information.observed 2026-08-03 - Probable[IAPP](https://iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-2-obligations-and-rights) — PIPL requires handlers to adopt organizational and technical measures to prevent unauthorized access, damage, leakage or loss of personal information, including internal management mechanisms, classification of personal information, encryption and de-identification, access controls, and periodic security training.observed 2026-08-03 - Probable[IAPP](https://iapp.org/news/a/top-5-operational-impacts-chinas-pipl-part-3-personal-information-protection-officer) — Under PIPL Article 57, whenever a leak, distortion or loss of personal information occurs or might have occurred, handlers must adopt remedial measures and notify relevant departments and affected individuals of the information categories, causes and possible harm, the remedial measures taken and steps individuals can take to mitigate harm, and a method of contact; notification to individuals is excused where the handler adopts measures effectively avoiding harm.observed 2026-08-03 - Probable[IAPP](https://iapp.org/news/a/china-issues-the-regulations-on-network-data-security-management-what-s-important-to-know) — The Regulations on Network Data Security Management require a company processing personal data of more than 10 million individuals to establish a dedicated department and appoint a senior data-security executive, and to submit a data disposal plan to regulators upon a merger, acquisition, spin-off or insolvency affecting data security.observed 2026-08-03