GB/T 42012-2022Information security technology—Data security requirements for instant messaging services (English PDF)
信息安全技术 即时通信服务数据安全要求
This is a limited preview
Buy now to download the full PDF (15 pages)
Need quotation for your management?
Get a formal quotation for GB/T 42012-2022 in 30 minutes.
Issued by
SAMR; SAC
Level / Type
National · Recommended
Issue date
October 14, 2022
Implementation date
May 1, 2023
Scope
GB/T 42012-2022 is the English-translated version of 信息安全技术 即时通信服务数据安全要求.
GB/T 42012-2022 sets the data security requirements for instant messaging services in China, following the data through collection, storage, transmission, use, processing, provision, disclosure, deletion and transfer out of the country.
It starts from the business composition of such a service and the scope of its data, then covers the collection of user information, the system permissions an app may ask for, informed consent, data display and processing, provision and public disclosure, deletion, and the rights of the personal information subject to access, correct and delete information and to withdraw consent; two clauses cover special scenarios, the protection of minors and measures against online fraud.
Its definitions distinguish personal from organizational messaging and cover single chat, group chat and chat rooms. Issued on 14 October 2022, it has applied since 1 May 2023.
Found what you need?
Document preview — GB/T 42012-2022
National Standard of the People's Republic of China
- ICS
- 35.030
- Classification
- L 80
Issued by: State Administration for Market Regulation; Standardization Administration of the PRC
Contents
- Preface
- 1 Scope
- 2 Normative references
- 3 Terms and Definitions
- 4 Abbreviations
- 5 Overview
- 5.1 Instant Messaging Service Business Composition
- 5.2 IM Service Data Scope
- 6 Basic requirements
- 7 Data collection
- 7.1 Collection of User Information
- 7.2 Applying for system permissions
- 7.3 Informed consent
- 8 Data Storage and Transmission
- 8.1 Data Storage
- 8.2 Data transfer
- 9 Data use and processing
- 9.1 Data Display
- 9.2 Data Processing
- 10 Data provision and disclosure
- 11 Data deletion
- 12 Data Exit
- 13 Rights of Personal Information Subjects
- 13.1 Access and Correction of Personal Information
- 13.2 Deletion of personal and organizational information
- 13.3 Individual withdrawal of consent
- 14 Special Scenarios for Instant Messaging Services
- 14.1 Protection of minors
- 14.2 Protective measures against online fraud
- Appendix A (Informative) Instant Messaging Service Data Processing Activities and Security Risks
- Appendix B (Informative) Reference Rules for Identification of Important Data of Instant Messaging Service and Example of Data Classification
- Appendix C (Informative) Common Extended Business Functions of Personal Instant Messaging Services Scope of Collection of Personal Information
- Appendix D (Informative) Application Scope and Usage Requirements for App-related System Permissions of Instant Messaging Service
- Reference
Foreword
This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules of Standardization Documents" drafted.
1 Scope
This document specifies the data processing activities of instant messaging service collection, storage, transmission, use, processing, provision, disclosure, deletion, and exit. safety requirements.
This document applies to instant messaging service providers to regulate data processing activities, and can also be used by regulatory authorities and third-party evaluation agencies for instant messaging Provide reference for the supervision, management and evaluation of information service data processing activities.
2 Normative references
The contents of the following documents constitute essential provisions of this document through normative references in the text. Among them, dated citations documents, only the version corresponding to that date applies to this document; for undated references, the latest edition (including all amendments) applies to this document.
GB/T 25069 Information Security Technical Terminology
GB/T 35273-2020 Information Security Technology Personal Information Security Specification
GB/T 37964 Information Security Technology Guidelines for De-identification of Personal Information
GB/T 37988 Information Security Technology Data Security Capability Maturity Model
GB/T 39335 Information Security Technology Personal Information Security Impact Assessment Guide
GB/T 41391-2022 Basic requirements for the collection of personal information by mobile Internet applications (Apps) of information security technology
GB/T 41479 Information Security Technology Network Data Processing Security Requirements
3 Terms and Definitions
The terms and definitions defined in GB/T 25069 and GB/T 35273-2020 and the following terms and definitions apply to this document.
3.1 Instant messaging service
Provide users with sending and receiving information (text, pictures, files, audio Online real-time interactive services for videos, links, etc.).
Note 1. The instant messaging service referred to in this document is mainly for related business services, and the internal self-built or self-use services of the organization are not included.
Note 2. For the instant messaging service referred to in this document, typical application scenarios include single chat (direct interaction between two users, between users and administrators), group chat (in the Send and receive instant messages in groups), chat room (a kind of online space for multi-person online real-time chat), instant messaging-based social, community, online customer service, Organizing communications, etc.
3.2 Instant messaging service for individual users
3.3 Organizational instant messaging service
Instant messaging service for office scenarios of organizations (such as enterprises, government agencies, etc.).
......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 15 pages — is available in the English PDF.
Referenced standards
Normative references
- GB/T 25069Information security techniques—Terminology
- GB/T 35273-2020Information security technology—Personal information security specification
- GB/T 37964Information security technology—Guide for de-identifying personal information
- GB/T 37988Information security technology—Data security capability maturity model
- GB/T 39335Information security technology—Guidance for personal information security impact assessment
- GB/T 41391-2022Information security technology—Basic requirements for collecting personal information in mobile internet applications
Similar standards
How to Download GB/T 42012-2022
- 1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
- 2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
- 3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
- 4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.
Related Standards
GB/T 25069-2022 — Information security techniques—Terminology
GB/T 35273-2020 — Information security technology—Personal information security specification
GB/T 37964-2019 — Information security technology—Guide for de-identifying personal information
Secure payment via Stripe
Payments accepted
GB/T 42012-2022
$240.00