GB/T 41817-2022Information security technology—Guidelines for personal information security engineering (English PDF)

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules of Standardization Documents" drafted.

Introduction

In order to regulate the personal information processing activities of network products and services, and protect the rights and interests of users' personal information to the greatest extent, the industry has successively proposed personal information.

The concept of simultaneous planning, simultaneous construction and simultaneous use of information security measures and products and services. For example, the EU General Data Protection Regulation stipulates that In the product design stage, personal information protection requirements should be considered, and the default settings of the product should also protect the user's personal information to the greatest extent possible. this is not It only helps to actively defend against personal information security risks, and it is also convenient to prevent the occurrence of incidents that infringe on the rights and interests of users' personal information.

In accordance with the requirements of personal information protection laws, regulations and policy standards, and in combination with domestic and foreign practical experience in privacy engineering, this document gives The guidelines for the implementation of personal information security projects in the planning and construction stages of network products and services with functions of processing personal information are published.

Provide engineering guidelines for network products and services to improve personal information protection capabilities. Information Security Technology Personal Information Security Engineering Guide

1 Scope

This document presents the principles, objectives, stages and preparations of personal information security engineering, providing network products and services in terms of requirements, design, Engineering guidelines for implementing personal information security requirements during development, testing, and release.

This document applies to network products and services (including information systems) involving personal information processing, for which the simultaneous planning and simultaneous construction of personal information It provides guidance on information security measures and is also suitable for organizations to refer to when conducting privacy engineering in the software development life cycle.

Note: In the case of not causing confusion, the "network products and services" in this document are simply referred to as "products and services".

2 Normative references

The contents of the following documents constitute essential provisions of this document through normative references in the text. Among them, dated citations documents, only the version corresponding to that date applies to this document; for undated references, the latest edition (including all amendments) applies to this document.

GB/T 25069-2022 Information Security Technical Terminology

GB/T 35273-2020 Information Security Technology Personal Information Security Specification

GB/T 39335-2020 Information Security Technology Personal Information Security Impact Assessment Guidelines

GB/T 41391-2022 Basic requirements for the collection of personal information by mobile Internet applications (Apps) of information security technology

3 Terms and Definitions

The terms and definitions defined in GB/T 25069-2022 and the following apply to this document.