#
Financial-sector and employment-data overlays are documented, but health, education and insurance sector-specific DP overlays were not located in this pass and are flagged as a research gap.
Sub-modules (7)
Financial Sector OverlayAmber
PBOC's Financial Data Security — Data Security Classification Guidelines (2020) impose sector-specific classification duties, and the amended Anti-Money Laundering Law (effective 1 Jan 2025) requires financial institutions to protect KYC/AML data confidentiality consistent with CSL/DSL/PIPL and to report before cross-border KYC/transaction-record disclosures to foreign authorities.
Claims (1):
- The People's Bank of China issued the Financial Data Security — Data Security Classification Guidelines establishing sector-specific data classification obligations for financial institutions, and the amended Anti-Money Laundering Law (effective 1 Jan 2025) requires financial institutions to protect the confidentiality of collected KYC/AML information consistent with CSL/DSL/PIPL and to report to the competent Chinese financial regulator before disclosing customers' KYC information or transactional records to foreign authorities.
Health Sector OverlayRed
No dedicated health-sector data protection statute distinct from PIPL's general treatment of 'medical health information' as sensitive personal information was identified.
Telecoms And EprivacyAmber
China lacks a discrete ePrivacy-style instrument; illustrative enforcement includes MIIT's 2021 sweep ordering WeChat, Tencent and other apps to rectify illegal transfer of contact-list and location data and pop-up harassment practices.
Claims (1):
- MIIT found that a batch of applications, including WeChat and other Tencent products, illegally transferred users' contact-list and location data and used pop-up harassment, ordering their parent companies to make rectifications.
Employment DataGreen
Under the CBDT relaxations, employee-data transfers are exempt from all CBDT legal mechanisms irrespective of volume, provided underlying Chinese employment-law conditions (e.g., democratically consulted employee handbooks) are met.
Claims (1):
- Under the CBDT regulations, employee data transfers are exempt from any of the CBDT legal mechanisms irrespective of data volume, provided companies meet relevant Chinese employment-law conditions extending beyond data protection rules (e.g., a democratically consulted employee handbook).
Credit And ScoringAmber
PIPL Article 67 allows violations to be recorded into a handler's 'credit files' under China's national social credit system, layering credit-scoring consequences onto ordinary administrative penalties.
Claims (1):
- PIPL Article 67 provides that violations may be recorded into the 'credit files' of the processing entity under China's national social credit system, in addition to monetary penalties.
EducationRed
No education-sector-specific data protection overlay was identified in this research pass.
InsuranceAmber
Insurance-sector data processing falls within the general financial-regulator enforcement lane under PIPL Arts 60/63; no insurance-specific data rule distinct from the general financial-sector overlay was located.
Claims (1):
- PIPL Article 60 designates financial regulators (which encompass insurance-sector oversight) among the sectoral supervisory authorities empowered to enforce PIPL within their respective designated areas.
no periodic updates on record for this sub-brief
Sources and claims (5)
- ProbableIAPP — The People's Bank of China issued the Financial Data Security — Data Security Classification Guidelines establishing sector-specific data classification obligations for financial institutions, and the amended Anti-Money Laundering Law (effective 1 Jan 2025) requires financial institutions to protect the confidentiality of collected KYC/AML information consistent with CSL/DSL/PIPL and to report to the competent Chinese financial regulator before disclosing customers' KYC information or transactional records to foreign authorities.observed
- ProbableIAPP — MIIT found that a batch of applications, including WeChat and other Tencent products, illegally transferred users' contact-list and location data and used pop-up harassment, ordering their parent companies to make rectifications.observed
- ProbableIAPP — Under the CBDT regulations, employee data transfers are exempt from any of the CBDT legal mechanisms irrespective of data volume, provided companies meet relevant Chinese employment-law conditions extending beyond data protection rules (e.g., a democratically consulted employee handbook).observed
- ProbableIAPP — PIPL Article 67 provides that violations may be recorded into the 'credit files' of the processing entity under China's national social credit system, in addition to monetary penalties.observed
- ProbableIAPP — PIPL Article 60 designates financial regulators (which encompass insurance-sector oversight) among the sectoral supervisory authorities empowered to enforce PIPL within their respective designated areas.observed