GB/T 35273-2020Information security technology—Personal information security specification (English PDF)

3.1 Personal information

Various information recorded electronically or in other ways that can identify the identity of a particular natural person or reflect the activities of a particular natural person, alone or in combination with other information.

3.2 Personal sensitive information

Personal information that, once leaked, illegally provided or abused, may endanger personal and property security, be easy to cause personal reputation, physical and mental health damage or discriminatory treatment.

3.3 Personal information subject

Natural persons identified or associated with personal information.

3.4 Personal information controller

An organization or individual who has the ability to determine the purpose and method of processing personal information.

3.5 Collect

The act of gaining control of personal information.

Note 1. This includes activities such as being actively provided by personal

3.6 Explicit consent

The personal information subject actively makes statements in paper or electronic form in written, oral, etc., or autonomously makes affirmative actions, to make explicit authorization for the specific processing of their personal information.

5.1 Legality of collecting personal information

Requirements for personal information controllers include.

5.3 Independent choice of multiple business functions

When a product or service provides multiple business functions that require the collection of personal information, the personal information controller shall not violate the autonomous will of the personal information subject and force the personal information subject to accept the business function provided by the product or service and the corresponding personal information collection request. Requirements for personal information controllers include.

5.4 Consent on collecting personal information

Requirements for personal information controllers include.

5.5 Personal information protection policy

Requirements for personal information controllers include.

5.6 Exceptions with authorized consent

In the following situations, the personal information controller does not need to obtain the consent of the personal information subject to collect and use personal information.

a) Relevant to the personal information controller's performance of its obligations under laws and regulations;

b) Directly related to national security and national defense security;

c) Directly related to public security, public health, major public interests;

d) Directly related to criminal investigation, prosecution, trial and judgment execution;

e) Out of the protection of the important legal rights and interests of the personal information subject or other individuals' lives, property, etc., but it is difficult to obtain consent;

f) The personal information involved is disclosed to the public by the personal information subject;

g) Necessary to sign and perform the contract according to the requirements of the personal information subject;

h) Collect personal information from legally publicly disclosed information, such as legal news reports, government information disclosure and other channels;

6.1 Minimal storage time of personal information

Requirements for personal information controllers include.

6.2 De-identification

After collecting personal information, the personal information controller should immediately carry out de-identification and take technical and management measures, to store the information that can be used to recover personal identification separately from the de-identified information and strengthen access and use rights management.

6.3 Transmission and storage of personal sensitive information

Requirements for personal information controllers include.

6.4 Personal information controller ceases operations

When the personal information controller stops operating its products or services, it shall.

7.1 Access control measures for personal information

Requirements for personal information controllers include.

7.2 Restrictions on the display of personal information

Involving the display of personal information through the interface (such as display screen, paper), the personal information controller should take measures to de-identify the personal information to be displayed, to reduce the risk of personal information disclosure in the display link. For example, in the display of personal information, prevent unauthorized personnel and other persons than the personal information subject from unauthorized access to personal information.

7.3 Restrictions on the purpose of using personal information

Requirements for personal information controllers include.

7.4 Restrictions on the use of user profiling

Requirements for personal information controllers include.

7.6 Convergence and fusion of personal information collected

for different business purposes Requirements for personal information controllers include.

8.1 Inquiry of personal information

The personal information controller shall provide the personal information subject with a method to query the following information.

8.2 Correction of personal information

If the personal information subject finds that the personal information held by the personal information controller is wrong or incomplete, the personal information controller shall provide him with a method for requesting correction or supplementary information.

8.3 Deletion of personal information

Requirements for personal information controllers include.

8.4 Personal information subject withdraws consent

Requirements for personal information controllers include.

8.5 Personal information subject cancels account

Requirements for personal information controllers include.

8.6 Personal information subject obtains a copy of personal information

According to the request of the personal information subject, the personal information controller should provide the personal information subject with a method to obtain a copy of the following type of personal information, or directly transfer the copy of the following type of personal information to a third party designated by the personal information subject under the technically feasible conditions.

8.6 in a timely manner. It shall, within 30 days or within the time limit prescribed by laws and regulations, make a response and reasonable explanation; meanwhile notify the personal information subject of the resolution of external disputes.

8.7 Responding to requests from personal information subjects

Requirements for personal information controllers include.

8.8 Complaint management

The personal information controller shall establish a complaint management mechanism and complaint tracking process; respond to complaints within a reasonable time.

9.1 Entrusted processing

9.2 Sharing and transfer of personal information

When personal information controllers share and transfer personal information, they shall pay full attention to risks. The sharing and transfer of personal information, not due to acquisition, merger, reorganization, or bankruptcy, shall meet the following requirements. […]

9.3 Transfer of personal information during acquisition, merger, reorganization, bankruptcy

When the personal information controller is subject to changes such as acquisition, merger, reorganization, bankruptcy, etc., the requirements for the personal information controller include.

9.4 Public disclosure of personal information

In principle, personal information shall not be publicly disclosed. When the personal information controller is authorized by law or has reasonable grounds for public disclosure, it shall meet the following requirements. […]

9.6 Joint personal information controller

Requirements for personal information controllers include.

9.7 Third-party access management

When a personal information controller accesses a third-party product or service with the function of collecting personal information in its products or services and 9.1 and 9.6 are not applicable, the requirements for the personal information controller include.

When a personal information controller entrusts a third party to process personal information, it shall meet the following requirements. […]

9.8 Cross-border transmission of personal information

If the personal information collected and generated during operations within the People's Republic of China is provided overseas, the personal information controller shall comply with the relevant national regulations and standards. […]