Partners save 15% on every standard

Valid

GB/T 45574-2025Data security technology — Security requirements for processing of sensitive personal information (English PDF)

数据安全技术敏感个人信息处理安全要求

Open the GB/T 45574-2025 preview as PDF

Preview — first pages of GB/T 45574-2025 (full document: 17 pages)

This is a limited preview

Buy now to download the full PDF (17 pages)

Issued by

SAMR; SAC

Level / Type

National · Recommended

Issue date

April 25, 2025

Implementation date

November 1, 2025

Scope

GB/T 45574-2025 is the English-translated version of 数据安全技术敏感个人信息处理安全要求.

GB/T 45574-2025 is the Chinese national standard covering handling the personal data that hurts most when it leaks — how sensitive personal information is identified and what falls inside the category, the lawful basis and the limits on collection, the separate informed consent and the written form it sometimes takes, the security protection required of the holder, and the extra rules for biometrics, religious belief, specific identity, medical and financial records, whereabouts, and children under fourteen. Appendix A is normative, so what counts as sensitive is not left to the processor to decide. First edition, in force from 1 November 2025. Issued on 25 April 2025, it has been in force since 1 November 2025.

Document preview — GB/T 45574-2025

National Standard of the People's Republic of China

ICS: 35.030
Classification: L 80

Issued by: State Administration for Market Regulation; Standardization Administration of the PRC

PrefaceIII
1 Scope1
2 Normative references1
3 Terms and Definitions1
4 Identification and Definition of Sensitive Personal Information2
4.1 Identification of Sensitive Personal Information2
4.2 Definition of Sensitive Personal Information2
5 General security requirements for processing sensitive personal information3
5.1 Basic Requirements3
5.2 Legality of Collection3
5.3 Collection Requirements3
5.4 Informed consent3
5.5 Security protection requirements4
6 Special security requirements for processing sensitive personal information6
6.1 Biometric Information6
6.2 Religious Belief Information6
6.3 Specific identity information6
6.4 Medical and health information6
6.5 Financial Account Information6
6.6 Tracking information7
6.7 Personal information of minors under the age of 147
6.8 Other sensitive personal information8
Appendix A (Normative) Sensitive Personal Information Categories9
Appendix B (Informative) Template for obtaining written consent for processing sensitive personal information10 Reference11

Foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for standardization work Part 1: Structure and drafting rules for standardization documents" Drafting.

Please note that some of the contents of this document may involve patents. The issuing organization of this document does not assume the responsibility for identifying patents.

This document was proposed and coordinated by the National Cybersecurity Standardization Technical Committee (SAC/TC260).

This document was drafted by: China Electronics Standardization Institute, Information Engineering Institute of the Chinese Academy of Sciences, National Institute of Information Technology Security Research Center, Ant Technology Group Co., Ltd., Beijing Douyin Information Service Co., Ltd., Beijing Kuaishou Technology Co., Ltd., and the Ministry of Public Security’s Third Research Institute, First Research Institute of the Ministry of Public Security, National Computer Network Emergency Response Technical Processing Coordination Center, China Cyberspace Research Institute, China Software Evaluation Center Testing Center, Beijing Baidu Netcom Technology Co., Ltd., Peking University Cancer Hospital, China CITIC Bank Corporation, Beike Zhaofang (Beijing) Technology Co., Ltd., Alibaba (Beijing) Software Services Co., Ltd., Beijing Huapin Boyui Network Technology Co., Ltd., Shanghai Shizhuang Information Technology Co., Ltd.

Co., Ltd., China UnionPay Co., Ltd., SF Express Co., Ltd., Olympus (Beijing) Sales and Service Co., Ltd., Yidu Cloud (Beijing) Technology Co., Ltd., Philips (China) Investment Co., Ltd., Xiamen Meiyou Co., Ltd., Lantu Automotive Technology Co., Ltd., Zhongguancun Science and Technology Xuecheng City Brain Co., Ltd., Xi'an Jiaotong University, Beijing Xiaoju Technology Co., Ltd., Lenovo (Beijing) Co., Ltd., Huawei Technologies Co., Ltd.

Limited Company, Guangxi Power Grid Co., Ltd.

The main drafters of this document are: Yao Xiangzhen, Hu Ying, Chen Shu, Gao Chao, Shangguan Xiaoli, Niu D, Chen Lin, Hao Chunliang, Bai Xiaoyuan, Li Weijing, Wang Xin, Zhu Xuefeng, Sudan, Yu Dongsheng, Chen Yanru, Wang Hui, Jiang Wei, Yang Ting, Sun Shuo, Heng Fanxiu, Feng Sha, Zhang Chao, Huang Tianning, Wang Bin, Xu Yan, Liu Lei, Li Lin, Zhe Ze, Liang Wentao, Zhang Lingzi, Huang Penghua, Wang Yang, Xu Qi, Wang Wei, Cheng Wenjing, Liu Jun, Li Shi, Zhang Lingcui, Li Fenghua, Yang Tao, Shi Yuzhen, Liu Xiaocen, Gao Zhen, Luo Hongwei, Wang Pu, Gu Wei, Bian Le, Wei Zonghui, Liu Chaoping. Data security technology Security requirements for processing sensitive personal information

1 Scope

This document establishes the identification and definition of sensitive personal information, stipulates the general security requirements for the processing of sensitive personal information and the Handling special security requirements.

This document applies to personal information processors who carry out sensitive personal information processing activities, and also applies to regulatory authorities and third-party assessment agencies.

Supervise, manage and evaluate sensitive personal information processing activities.

2 Normative references

GB/T 35273

GB/T 40660

GB/T 41391

3 Terms and definitions

The following terms and definitions apply to this document.

3.1 Personal information

Any information relating to an identified or identifiable natural person recorded electronically or otherwise.

3.2 Personal information of adults

Personal information that, once leaked or illegally used, may easily cause infringement on a natural person’s personal dignity or endanger personal and property safety.

Note. Sensitive personal information includes biometrics, religious beliefs, specific identities, medical health, financial accounts, whereabouts, and information about minors under the age of 14.

3.3

Organizations and individuals who independently decide on the purpose and method of processing personal information in personal information processing activities.

3.4 [Source. GB/T 35273-2020, 3.3]

The natural person identified or associated with the Personal Information.

3.5

Activities such as collection, storage, use, processing, transmission, provision, disclosure and deletion of personal information.

......
This preview omits tables, figures, formulas and parts of the technical clauses. The complete document — 17 pages — is available in the English PDF.

Referenced standards

Normative references

Cited by

Editions of GB/T 45574

Edition	Title	Revision	Status
GB/T 45574-2025	Data security technology - Security requirements for processing of sensitive personal information	current edition	Current

This page sells the current edition, GB/T 45574-2025. Earlier editions are listed for reference only.

How to Buy GB/T 45574-2025

1Add to cart. Click the "Buy GB/T 45574-2025" button on this page. You can add more standards before checkout.
2Checkout. Enter your email and billing details. Payment is processed securely by Stripe (cards, Apple Pay, Google Pay supported).
3Instant delivery (0–9 sec). Delivery is automatic: within seconds of payment you'll receive an email with a secure download link. The link stays valid for 72 hours.
4Invoice included. A tax invoice is attached to the confirmation email. Need a custom invoice? Contact us.