Personal Information Protection Law
The Personal Information Protection Law is the basic Chinese law governing the processing of personal information. It sets out rules for handling sensitive personal information, the requirement for separate consent, and obligations to inform individuals. It is an important legal framework for data privacy compliance.
Core Facts
Timeline (last 90 days)
家庭安防设备涉及持续采集视频和音频数据，属于个人敏感信息范畴，在GDPR和国内《个人信息保护法》等法规框架下需遵循数据最小化、目的限制和用户同意等原则。
In heavily regulated industries such as finance, healthcare and law, cross-border data transfer and third-party processing are often strictly restricted by the Personal Information Protection Law, GDPR or industry regulatory rules.
The EU GDPR and China's Personal Information Protection Law both impose requirements on the granularity of notification, which is the legal backdrop for the argument that a brief explanation should be added next to the button.
China's Personal Information Protection Law classifies medical health, movement trajectories and the like as sensitive personal information, requiring separate consent and an explanation of necessity and impact.
Batch collection of map POI and enterprise business registration information involves the Personal Information Protection Law, the Data Security Law, and platform terms of service; if merchant phone numbers and addresses can be traced to natural persons, they may be deemed personal information, and unauthorized bulk scraping and use for marketing carries compliance risks.
Batch collection and import of phone numbers for marketing may touch the compliance red lines related to personal information protection.
Under the frameworks of the GDPR, the CCPA, and China's Personal Information Protection Law, automated decision-making must meet requirements such as notice and consent and the right to opt out.
Browser fingerprinting is personal data and under the GDPR, CCPA, and China's Personal Information Protection Law frameworks generally requires notice and a legal basis; for anti-fraud purposes, legitimate interest in security and abuse prevention can be invoked, but the principle of minimum necessity should be followed and only hashes should be stored.
Regulations such as the GDPR and the Personal Information Protection Law have strict provisions on biometric information and portrait rights.
WorkBuddy uses a cloud inference architecture, and the instructions and file contents entered by users must be uploaded to remote servers for processing, which may constitute a compliance risk for organizations bound by the Personal Information Protection Law, the Data Security Law, or industry regulation.
19 more timeline events
All Facts (20)
中国已实施《数据安全法》和《个人信息保护法》，对企业数据出境提出严格要求
80%VerifiedUnder regulatory frameworks such as GDPR and China's Personal Information Protection Law, user data breaches caused by code vulnerabilities may result in enormous fines.
65%UnverifiedUnder the Personal Information Protection Law and the Data Security Law, third-party software obtaining enterprise communication records requires explicit user authorization, and data processing must meet compliance requirements.
60%UnverifiedChina's cybersecurity legal framework is primarily composed of three pillars: the Cybersecurity Law (2017), the Data Security Law (2021), and the Personal Information Protection Law (2021).
60%Unverified家庭安防设备涉及持续采集视频和音频数据，属于个人敏感信息范畴，在GDPR和国内《个人信息保护法》等法规框架下需遵循数据最小化、目的限制和用户同意等原则。
50%UnverifiedIn heavily regulated industries such as finance, healthcare and law, cross-border data transfer and third-party processing are often strictly restricted by the Personal Information Protection Law, GDPR or industry regulatory rules.
50%UnverifiedThe EU GDPR and China's Personal Information Protection Law both impose requirements on the granularity of notification, which is the legal backdrop for the argument that a brief explanation should be added next to the button.
50%UnverifiedChina's Personal Information Protection Law classifies medical health, movement trajectories and the like as sensitive personal information, requiring separate consent and an explanation of necessity and impact.
50%UnverifiedBatch collection of map POI and enterprise business registration information involves the Personal Information Protection Law, the Data Security Law, and platform terms of service; if merchant phone numbers and addresses can be traced to natural persons, they may be deemed personal information, and unauthorized bulk scraping and use for marketing carries compliance risks.
50%UnverifiedBatch collection and import of phone numbers for marketing may touch the compliance red lines related to personal information protection.
50%UnverifiedUnder the frameworks of the GDPR, the CCPA, and China's Personal Information Protection Law, automated decision-making must meet requirements such as notice and consent and the right to opt out.
50%UnverifiedBrowser fingerprinting is personal data and under the GDPR, CCPA, and China's Personal Information Protection Law frameworks generally requires notice and a legal basis; for anti-fraud purposes, legitimate interest in security and abuse prevention can be invoked, but the principle of minimum necessity should be followed and only hashes should be stored.
50%UnverifiedRegulations such as the GDPR and the Personal Information Protection Law have strict provisions on biometric information and portrait rights.
50%UnverifiedWorkBuddy uses a cloud inference architecture, and the instructions and file contents entered by users must be uploaded to remote servers for processing, which may constitute a compliance risk for organizations bound by the Personal Information Protection Law, the Data Security Law, or industry regulation.
50%UnverifiedTest logs, DOM snapshots, and network traces often contain sensitive payloads, OAuth bearer tokens, PII, or internal infrastructure URLs, and passing raw context to an external LLM provider means significant compliance risk, requiring a strict sanitization layer before model ingestion.
50%UnverifiedChina's Personal Information Protection Law classifies the personal information of minors under the age of fourteen as sensitive personal information, and processing it requires obtaining the guardian's separate consent.
50%UnverifiedIn addition to GDPR, developers also need to pay attention to local regulations in different markets, such as China's Personal Information Protection Law and the US CCPA.
50%UnverifiedOfficially launching a SaaS product also involves account systems, billing and subscriptions, data compliance (such as GDPR and the Personal Information Protection Law), SLA guarantees, and customer service systems.
50%UnverifiedWhen enterprises call large models, prompts may carry sensitive information such as user names, phone numbers, ID card numbers and bank card numbers, and once sent to a third-party model provider it may constitute a data breach or violate regulations such as GDPR and the Personal Information Protection Law.
50%UnverifiedIn regulated industries such as finance, healthcare, and law, uploading non-anonymized documents to unapproved platforms may trigger compliance risks under GDPR or the Personal Information Protection Law.
50%