Valid

GB/T 42015-2022Information security technology—Data security requirements for internet payment services (English PDF)

信息安全技术网络支付服务数据安全要求

Preview PDF

This is a limited preview

Buy now to download the full PDF (15 pages)

Need quotation for your management?

Get a formal quotation for GB/T 42015-2022 in 30 minutes.

Issued by

SAMR; SAC

Level / Type

National · Recommended

Issue date

October 14, 2022

Implementation date

May 1, 2023

Scope

GB/T 42015-2022 is the English-translated version of 信息安全技术网络支付服务数据安全要求.

GB/T 42015-2022 sets the data security requirements for online payment services in China, and by its own definition covers the online payment business of non-bank payment institutions, leaving out payments made over near-field communication or private networks.

It follows the data through collection, storage, transmission, use, processing, provision, disclosure, deletion and transfer out of the country, and covers the system permissions an app may ask for, informed consent, data display, access and processing, and the rights of the personal information subject, then four typical scenarios: payment and identity authentication by biometric features, reconciliation, payment risk control and the security of payment passwords.

Among the standards it quotes are GB/T 40660 on biometric information and GB/T 41819 on face recognition data. Issued on 14 October 2022, it has applied since 1 May 2023.

Found what you need?

Document preview — GB/T 42015-2022

National Standard of the People's Republic of China

ICS: 35.030
Classification: L 80

Issued by: State Administration for Market Regulation; Standardization Administration of the PRC

Preface
1 Scope
2 Normative references
3 Terms and Definitions
4 Abbreviations
5 Overview
5.1 Composition of online payment service business
5.2 Network payment service data scope
6 Basic Requirements
7 Data Collection
7.1 Collection of personal information
7.2 App system permission application
7.3 Informed Consent
8 Data storage and transmission
9 Data usage and processing
9.1 Data display
9.2 Data Access
9.3 Data Processing
10 Data provision and disclosure
10.1 Data provision
10.2 Data disclosure
11 Data Deletion
12 Data Export
13 Rights of Personal Information Subject
14 Data Security Requirements for Typical Scenarios of Online Payment Services
14.1 Payment and identity authentication through biometric features
14.2 Reconciliation
14.3 Payment Risk Control
14.4 Payment Password Security
Appendix A (Informative) Data Processing Activities and Security Risks of Online Payment Services
Appendix B (Informative) Reference Rules for Identification of Important Data in Online Payment Services and Examples of Data Classification
Appendix C (Informative) Scope of Personal Information Collection and Use Requirements for Common Extended Business Functions of Online Payment Services
Appendix D (Informative) Scope of Application and Requirements for System Permissions Related to Online Payment Service App
Reference

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules for Standardization Documents" drafting.

1 Scope

This document specifies the data processing activities of online payment services such as collection, storage, transmission, use, processing, provision, disclosure, deletion, and export. security requirements.

This document is applicable to the standardization of data processing activities of network payment service providers, and can also be used by regulatory authorities and third-party evaluation agencies to regulate network payment service providers.

Provide reference for supervision, management and evaluation of payment service data processing activities.

2 Normative references

The contents of the following documents constitute the essential provisions of this document through normative references in the text. Among them, dated references For documents, only the version corresponding to the date is applicable to this document; for undated reference documents, the latest version (including all amendments) is applicable to this document.

GB/T 25069 Information Security Technical Terms

GB/T 35273-2020 Personal Information Security Specifications for Information Security Technology

GB/T 37988 Information Security Technology Data Security Capability Maturity Model

GB/T 39335 Information Security Technology Personal Information Security Impact Assessment Guidelines

GB/T 40660 Basic requirements for information security technology biometric identification information protection

GB/T 41391-2022 Information Security Technology Mobile Internet Application (App) Collection of Personal Information Basic Specifications

GB/T 41479 Information Security Technology Network Data Processing Security Specifications

GB/T 41819 Information Security Technology Face Recognition Data Security Requirements

3 Terms and Definitions

The following terms and definitions defined in GB/T 25069 and GB/T 35273-2020 apply to this document.

3.1 Online payment service

The payee or the payer completes the direct or indirect payment through electronic devices such as computers and mobile terminals, and relying on the Internet to remotely transmit payment instructions. The business activity of money transfer.

Note 1. Does not include payment services done using near-field communication and private networks.

Note 2. The online payment services mentioned in this document are limited to the online payment services of non-bank payment institutions.

3.2 Online payment service platform

Provide online payment service (3.1) for the payee and payer through the Internet network, and interact with the online payment service accounting platform (3.3) Information system to complete funds transfer.

3.3 Online payment service accounting platform

An information system that provides services such as account management, fund transfer, and accounting for online payment services (3.1).

......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 15 pages — is available in the English PDF.

Referenced standards

Normative references

Similar standards

GB/T 20272-2026|GB/T 20274.2-2026|GB/T 22186-2026|GB/T 24294.1-2026|GB/T 28455-2026|GB/T 31499-2026

How to Download GB/T 42015-2022

1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.