#
Lawful-basis and sensitive-data rules are enacted, detailed and actively enforced, though 'separate consent' remains only partially defined in official guidance.
Sub-modules (4)
Lawful BasesGreen
Article 13 lists non-consent lawful bases (contract performance/HR management, statutory duties, public-health emergencies, news reporting in the public interest, lawfully disclosed information); PIPL does not recognize a GDPR-style 'legitimate interests' basis.
Claims (1):
- PIPL Article 13 permits processing without consent where necessary for contract performance or HR management under lawfully formulated labor policies, to perform legal responsibilities, to respond to public health emergencies, for public-interest news reporting, or for lawfully disclosed information; PIPL does not recognize 'legitimate interests' as a lawful basis, unlike GDPR.
Consent ThresholdsAmber
Consent must be informed, freely given, evidenced by clear action and revocable (Arts 14–15); 'separate consent' (a higher, purpose-specific standard) is required for sharing, public disclosure, sensitive-data processing and cross-border transfer (Arts 23, 25, 29, 39).
Claims (1):
- Consent under PIPL must be informed, freely given and evidenced by a clear affirmative action, with a standing right of withdrawal (Arts 14–15); a heightened 'separate consent' is additionally required when handlers share PI with other handlers, publicly disclose PI, process sensitive PI, or transfer PI abroad (Arts 23, 25, 29, 39).
Special CategoriesGreen
Article 28 defines sensitive personal information broadly — biometric identification, religious beliefs, specially-designated status, medical/health data, financial accounts, location/whereabouts data, and personal information of minors under 14 — a wider sweep than GDPR Art 9.
Claims (1):
- PIPL Article 28 defines sensitive personal information to include biometric identification information, religious beliefs, specially-designated status, medical health information, financial accounts, information on individuals' whereabouts, and personal information of minors under the age of 14.
Pseudonymisation And AnonymisationGreen
Anonymized information (rendered permanently non-identifiable and non-restorable) falls outside PIPL's scope of 'personal information' (Arts 4 & 73); PIPL uses 'de-identification' as its pseudonymisation-equivalent concept.
Claims (1):
- Anonymized information is not deemed personal information under PIPL; anonymization is defined (Arts 4 & 73) as processing that renders data non-identifying and non-restorable to a specific natural person, while 'de-identification' functions as PIPL's pseudonymisation-equivalent concept.
No new data since the standing brief. 1 periodic run re-emitted it unchanged.
Sources and claims (4)
- ProbableIAPP — PIPL Article 13 permits processing without consent where necessary for contract performance or HR management under lawfully formulated labor policies, to perform legal responsibilities, to respond to public health emergencies, for public-interest news reporting, or for lawfully disclosed information; PIPL does not recognize 'legitimate interests' as a lawful basis, unlike GDPR.observed
- ProbableIAPP — Consent under PIPL must be informed, freely given and evidenced by a clear affirmative action, with a standing right of withdrawal (Arts 14–15); a heightened 'separate consent' is additionally required when handlers share PI with other handlers, publicly disclose PI, process sensitive PI, or transfer PI abroad (Arts 23, 25, 29, 39).observed
- ProbableIAPP — PIPL Article 28 defines sensitive personal information to include biometric identification information, religious beliefs, specially-designated status, medical health information, financial accounts, information on individuals' whereabouts, and personal information of minors under the age of 14.observed
- ProbableIAPP — Anonymized information is not deemed personal information under PIPL; anonymization is defined (Arts 4 & 73) as processing that renders data non-identifying and non-restorable to a specific natural person, while 'de-identification' functions as PIPL's pseudonymisation-equivalent concept.observed