Valid

GB/T 42017-2022Information security technology—Data security requirements for online ride-hailing services (English PDF)

信息安全技术网络预约汽车服务数据安全要求

Preview PDF

This is a limited preview

Buy now to download the full PDF (25 pages)

Need quotation for your management?

Get a formal quotation for GB/T 42017-2022 in 30 minutes.

Issued by

SAMR; SAC

Level / Type

National · Recommended

Issue date

October 14, 2022

Implementation date

May 1, 2023

Scope

GB/T 42017-2022 is the English-translated version of 信息安全技术网络预约汽车服务数据安全要求.

GB/T 42017-2022 sets the data security requirements for online ride-hailing services in China, following the data through collection, storage, use, processing, provision, disclosure and transfer out of the country.

It covers the collection of personal information from passengers and drivers, the system permissions an app may ask for, informed consent, access control, how personal information is displayed, the use of user profiles and of a driver's credit history, the public disclosure of unlawful information, and the rights of passengers and drivers to see, copy, correct and delete their data, complain, withdraw consent and close an account; a whole clause covers the audio and video recordings made during a trip, from collection to use, storage and deletion.

Private car sharing, ride-hailing freight and ride-hailing buses are outside it. Issued on 14 October 2022, it has applied since 1 May 2023.

Found what you need?

Document preview — GB/T 42017-2022

National Standard of the People's Republic of China

ICS: 35.030
Classification: L 80

Issued by: State Administration for Market Regulation; Standardization Administration of the PRC

Preface
1 Scope
2 Normative references
3 Terms and Definitions
4 Abbreviations
5 Overview
5.1 Composition of online car reservation service business
5.2 Data Scope of Online Booking Car Service
6 Basic requirements
7 Data collection
7.1 Collection of personal information
7.2 Applying for system permissions
7.3 Informed consent
8 Data storage
9 Data use and processing
9.1 Data Access Control
9.2 Display of personal information
9.3 User portrait use
9.4 Use of driver credit history
10 Data provision and disclosure
10.1 Data provision
10.2 Public disclosure of illegal information
11 Data Exit
12 Passenger and Driver Personal Information Rights
12.1 Access and copying of personal information
12.2 Correction or Supplement of Personal Information
12.3 Personal Information Complaints
12.4 Individual Withdrawal of Consent
12.5 Deletion of personal information
12.6 Cancellation of accounts by passengers and drivers
13 Data security requirements for audio and video recordings of the itinerary
13.1 Basic requirements for data security of audio and video recordings of the itinerary
13.2 Collection of audio and video recordings of the trip
13.3 The use of audio and video recordings of the trip
13.4 Storage and deletion of audio and video recordings of the trip
Appendix A (Informative) Online Car Booking Service Data Processing Activities and Data Security Risks
Appendix B (Informative) Reference Rules and Data Classification Examples for Important Data Identification of Online Car Booking Service
Appendix C (Informative) Personal Information of Drivers and Common Extended Business Functions Collection of Personal Information Scope and Usage Requirements
Appendix D (Informative) Scope of Application for Permissions and Usage Requirements of the App-related System for Online Car Booking Service
Appendix E (Informative) Sample Trip Recording Collection Protocol Template
Appendix F (Informative) Data Security Protection Requirements for Complaint Handling Scenarios
Appendix G (Informative) Example of Data Desensitization Rules for Online Car Booking Service
Appendix H (Informative) Example
Reference

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1: Structure and Drafting Rules of Standardization Documents" drafted.

1 Scope

This document specifies the security of data processing activities such as the collection, storage, use, processing, provision, disclosure, and exit of online car reservation services Require.

This document is applicable to the standard data processing activities of online car reservation service providers, and can also be used by regulatory authorities and third-party evaluation agencies for online Provide reference for monitoring, management, and evaluation of online car reservation service data processing activities.

2 Normative references

The contents of the following documents constitute essential provisions of this document through normative references in the text. Among them, dated citations documents, only the version corresponding to that date applies to this document; for undated references, the latest edition (including all amendments) applies to this document.

GB/T 25069 Information Security Technical Terminology

GB/T 35273-2020 Information Security Technology Personal Information Security Specification

GB/T 37988 Information Security Technology Data Security Capability Maturity Model

GB/T 39335 Information Security Technology Personal Information Security Impact Assessment Guide

GB/T 41391-2022 Basic requirements for the collection of personal information by mobile Internet applications (Apps) of information security technology

GB/T 41479 Information Security Technology Network Data Processing Security Requirements

3 Terms and Definitions

The terms and definitions defined in GB/T 25069 and GB/T 35273-2020 and the following terms and definitions apply to this document.

3.1 Online car reservation service

Relying on Internet technology to build a service platform, integrate supply and demand information, and provide users with the operation of online booking car travel services Activity.

Note: The online car booking service in this document mainly refers to the online taxi booking (referred to as "online car booking") service, excluding private passenger car sharing (commonly known as "shun"). Windmill"), ride-hailing freight and ride-hailing buses.

3.2 Online car reservation service platform

Integrate travel supply and demand information through network information technology, use qualified vehicles and drivers, and provide information on online car reservations information system.

3.3 Online car reservation service provider

Organizations that provide online car booking services using the online car booking service platform.

Note: The online car reservation service provider in this document mainly refers to the operator of the online car reservation service platform.

......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 25 pages — is available in the English PDF.

Referenced standards

Normative references

Similar standards

GB/T 20272-2026|GB/T 20274.2-2026|GB/T 22186-2026|GB/T 24294.1-2026|GB/T 28455-2026|GB/T 31499-2026

How to Download GB/T 42017-2022

1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.