--- title: "China — Lawful Processing & Special Data | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/china/lawful-processing-and-special-data/ source_html: /jurisdictions/china/lawful-processing-and-special-data/index.html description: "China — Lawful Processing & Special Data: lawful_processing_and_special_data Lawful Processing & Special Data 4 sub-modules 4 claims Green ▾ # Lawful-basis and sensitive-data rules are enacted, detailed and actively enforc" generated_at: 2026-10-25T04:46:50Z content_sha256: ceccb60e69f4518da4d2440b4efb9fba6330397c44c3a4aed1911ec135977c0f generator: "fe-fleet/md-twin@1.0" --- # China — Lawful Processing & Special Data | Data Protection Monitor ### D2Lawful Processing & Special Data4 sub-modules4 claimsGreen▾# Lawful-basis and sensitive-data rules are enacted, detailed and actively enforced, though 'separate consent' remains only partially defined in official guidance. Primary framework PIPL Chapter II, Arts 13–30; GB/T 35273 (Personal Information Security Specification, amendments proposed June 2026) Supervisory authority [Cyberspace Administration of China (CAC)](https://www.cac.gov.cn/) Traffic-light rationale — Green Lawful-basis and sensitive-data rules are enacted, detailed and actively enforced, though 'separate consent' remains only partially defined in official guidance. #### Sub-modules (4) #### Lawful BasesGreen Article 13 lists non-consent lawful bases (contract performance/HR management, statutory duties, public-health emergencies, news reporting in the public interest, lawfully disclosed information); PIPL does not recognize a GDPR-style 'legitimate interests' basis. Claims (1): - PIPL Article 13 permits processing without consent where necessary for contract performance or HR management under lawfully formulated labor policies, to perform legal responsibilities, to respond to public health emergencies, for public-interest news reporting, or for lawfully disclosed information; PIPL does not recognize 'legitimate interests' as a lawful basis, unlike GDPR. #### Consent ThresholdsAmber Consent must be informed, freely given, evidenced by clear action and revocable (Arts 14–15); 'separate consent' (a higher, purpose-specific standard) is required for sharing, public disclosure, sensitive-data processing and cross-border transfer (Arts 23, 25, 29, 39). Claims (1): - Consent under PIPL must be informed, freely given and evidenced by a clear affirmative action, with a standing right of withdrawal (Arts 14–15); a heightened 'separate consent' is additionally required when handlers share PI with other handlers, publicly disclose PI, process sensitive PI, or transfer PI abroad (Arts 23, 25, 29, 39). #### Special CategoriesGreen Article 28 defines sensitive personal information broadly — biometric identification, religious beliefs, specially-designated status, medical/health data, financial accounts, location/whereabouts data, and personal information of minors under 14 — a wider sweep than GDPR Art 9. Claims (1): - PIPL Article 28 defines sensitive personal information to include biometric identification information, religious beliefs, specially-designated status, medical health information, financial accounts, information on individuals' whereabouts, and personal information of minors under the age of 14. #### Pseudonymisation And AnonymisationGreen Anonymized information (rendered permanently non-identifiable and non-restorable) falls outside PIPL's scope of 'personal information' (Arts 4 & 73); PIPL uses 'de-identification' as its pseudonymisation-equivalent concept. Claims (1): - Anonymized information is not deemed personal information under PIPL; anonymization is defined (Arts 4 & 73) as processing that renders data non-identifying and non-restorable to a specific natural person, while 'de-identification' functions as PIPL's pseudonymisation-equivalent concept. Category narrative 90 words PIPL Chapter II sets out non-consent lawful bases (contract performance, HR management, statutory duties, public health emergencies, news reporting, lawfully disclosed information) alongside consent; unlike GDPR, PIPL does not recognize 'legitimate interests'. Elevated 'separate consent' is required for sensitive categories, sharing, public disclosure and cross-border transfers. Sensitive personal information (Art 28) is broadly defined to include biometric data, religious beliefs, specially-designated status, health, financial accounts, location data and the personal information of minors under 14. Anonymized data is excluded from scope, and 'de-identification' (pseudonymisation) is recognized as a risk-mitigation concept. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Evidence 4 Sources and claims (4) - Probable[IAPP](https://iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-2-obligations-and-rights) — PIPL Article 13 permits processing without consent where necessary for contract performance or HR management under lawfully formulated labor policies, to perform legal responsibilities, to respond to public health emergencies, for public-interest news reporting, or for lawfully disclosed information; PIPL does not recognize 'legitimate interests' as a lawful basis, unlike GDPR.observed 2026-08-03 - Probable[IAPP](https://iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-2-obligations-and-rights) — Consent under PIPL must be informed, freely given and evidenced by a clear affirmative action, with a standing right of withdrawal (Arts 14–15); a heightened 'separate consent' is additionally required when handlers share PI with other handlers, publicly disclose PI, process sensitive PI, or transfer PI abroad (Arts 23, 25, 29, 39).observed 2026-08-03 - Probable[IAPP](https://iapp.org/news/a/analyzing-chinas-pipl-and-how-it-compares-to-the-eus-gdpr) — PIPL Article 28 defines sensitive personal information to include biometric identification information, religious beliefs, specially-designated status, medical health information, financial accounts, information on individuals' whereabouts, and personal information of minors under the age of 14.observed 2026-08-03 - Probable[IAPP](https://iapp.org/news/a/analyzing-chinas-pipl-and-how-it-compares-to-the-eus-gdpr) — Anonymized information is not deemed personal information under PIPL; anonymization is defined (Arts 4 & 73) as processing that renders data non-identifying and non-restorable to a specific natural person, while 'de-identification' functions as PIPL's pseudonymisation-equivalent concept.observed 2026-08-03