Valid

GB/T 43435-2023Information security technology—Security requirements for software development kit (SDK) in mobile internet applications (App) (English PDF)

信息安全技术移动互联网应用程序（App）软件开发工具包（SDK）安全要求

Preview PDF

This is a limited preview

Buy now to download the full PDF (17 pages)

Need quotation for your management?

Get a formal quotation for GB/T 43435-2023 in 30 minutes.

Issued by

SAMR; SAC

Level / Type

National · Recommended

Issue date

November 27, 2023

Implementation date

June 1, 2024

Scope

GB/T 43435-2023 is the English-translated version of 信息安全技术移动互联网应用程序（App）软件开发工具包（SDK）安全要求.

GB/T 43435-2023 sets security requirements for the software development kits embedded in mobile internet applications.

It covers the SDK life cycle - design, development, release, operation and termination of operation - and then the processing of personal information, with a subclause each for collection, storage, use and processing, transfer, provision, disclosure and deletion.

An opening clause describes SDK usage scenarios and SDK security risks, and four informative annexes list common SDK service types, common security vulnerabilities, common malicious behaviours and common personal information problems.

Clause 1 states that the document is for SDK development and operation and is used as a reference for SDK security testing and evaluation. Among the standards it quotes are GB/T 25069-2022, GB/T 34975-2017, GB/T 35273-2020, GB/T 37964-2019 and GB/T 41391-2022. Issued on 27 November 2023, it has applied since 1 June 2024.

Found what you need?

Document preview — GB/T 43435-2023

National Standard of the People's Republic of China

ICS: 35.030
Classification: L 80

Issued by: State Administration for Market Regulation; Standardization Administration of the PRC

Preface
1 Scope
2 Normative references
3 Terms and Definitions
4 Overview
4.1 SDK usage scenario
4.2 SDK security risks
5 Security requirements for SDK design, development, release, operation, termination of operation and other stages
5.1 Design
5.2 Development
5.3 Release
5.4 Operation
5.5 Termination of operations
6 SDK personal information processing security requirements
6.1 Collection of personal information
6.2 Personal information storage
6.3 Use and processing of personal information
6.4 Transfer of personal information
6.5 Provision of personal information
6.6 Disclosure of personal information
6.7 Deletion of personal information
Appendix A (informative) Common SDK service types
Appendix B (informative) Common SDK security vulnerabilities
Appendix C (informative) Common SDK malicious behaviors
Appendix D (informative) Common SDK handling personal information security issues

Foreword

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part 1: Structure and Drafting Rules of Standardization Documents" Drafting.

1 Scope

This document stipulates the design, development, release, operation and termination of mobile Internet application (App) software development kit (SDK) and other stages and security requirements for personal information processing activities.

This document is applicable to SDK development and operation, and is used as a reference for SDK security testing and evaluation.

2 Normative reference documents

The contents of the following documents constitute essential provisions of this document through normative references in the text. Among them, the dated quotations For undated referenced documents, only the version corresponding to that date applies to this document; for undated referenced documents, the latest version (including all amendments) applies to this document.

GB/T 25069-2022 Information security technical terms

GB/T 34975-2017 Information security technology mobile intelligent terminal application software security technical requirements and testing and evaluation methods

GB/T 35273-2020 Information Security Technology Personal Information Security Specifications

GB/T 37964-2019 Information Security Technology Personal Information De-Identification Guidelines

GB/T 41391-2022 Information Security Technology Basic Requirements for Mobile Internet Applications (Apps) to Collect Personal Information

3 Terms and definitions

The following terms and definitions defined in GB/T 25069-2022, GB/T 35273-2020, GB/T 41391-2022 apply to this document.

3.1 Software libraries to assist in software development

Note: A software development kit typically includes a collection of related binaries, APIs, documentation, examples, and tools. [Source: GB/T 41391-2022, 3.14, with modifications]

3.2 SDK operator

Developer, owner, manager or provider of software development kits.

Note: The abbreviation of SDK operator also includes SDK-related personal information processors.

3.3 App operator

Developer, owner, manager or provider of mobile Internet applications.

Note: referred to as App operator, it also includes App-related personal information processors. [Source: GB/T 41391-2022, 3.2, with modifications]

......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 17 pages — is available in the English PDF.

Referenced standards

Normative references

Similar standards

GB/T 20272-2026|GB/T 20274.2-2026|GB/T 22186-2026|GB/T 24294.1-2026|GB/T 28455-2026|GB/T 31499-2026

How to Download GB/T 43435-2023

1
Add to cart
Click "Download PDF" on this page and choose "Buy this standard". You can add more standards before checkout.
2
Checkout
Enter your email and billing details. Payment is processed securely by Stripe (cards or bank transfer). Prefer bank details? Request a quotation (min. order $300).
3
Instant delivery (0–9 sec)
Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
4
Invoice included
A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.