Assess the activity before it happens
PIPL Article 55 requires prior personal information protection impact assessment and a record of processing in the listed circumstances. Article 56 asks whether the purpose and method are lawful, legitimate and necessary, what the rights impacts and security risks are, and whether safeguards are lawful, effective and proportionate. The task is to explain a real proposed activity and the reasons for the decision, not merely attach a completed checklist.
Define the legal entity, service, individuals, fields, recipients, systems and retention before scoring risk. If those facts are still changing, record the assumptions and decisions that remain open. A claim that an assessment is complete should not hide a still-unknown recipient or an untested deletion mechanism.
Identify the trigger and the facts that support it
The following matrix paraphrases Article 55 and adds original screening questions. Several triggers can apply to one activity. A low headcount does not by itself erase a statutory trigger; later small-processor provisions may simplify the way the work is performed, as discussed below.
| Article 55 category | Question to resolve | Useful evidence |
|---|---|---|
| Sensitive personal information | Which fields are sensitive, and why are they necessary for this purpose? | Field inventory, classification rationale, less-intrusive alternatives. |
| Automated decision-making | How does the system produce a decision about a person and how can the person challenge it? | Decision logic, review workflow, fairness tests and user information. |
| Entrustment, provision to another processor or public disclosure | What is each recipient's role, permitted purpose and actual access? | Role analysis, agreement, access settings and onward-processing map. |
| Provision outside China | What leaves or is accessible overseas, by whom and under what safeguards? | Transfer map, recipient capability, rights channels and separate route analysis. |
| Other significant effects on personal rights | Could the activity materially change a person's opportunities, treatment or exposure? | Impact reasoning, affected groups, foreseeable misuse and controls. |
Build a record that can be challenged and checked
A practical assessment connects facts, a rights risk, the control addressing it and evidence that the control works. Separate evidence from a supplier's assurance and a future action. The working structure below is our editorial aid; it is not an official mandatory form or a regulatory acceptance guarantee.
| Decision block | What to record | Weak answer to avoid |
|---|---|---|
| Purpose and necessity | The specific task, each required data category and an alternative considered. | 'Business needs' without linking fields to the task. |
| Rights impact and security risk | Who may be harmed, how, under which misuse or failure conditions. | A numeric risk score with no underlying scenario. |
| Safeguards and effectiveness | Control owner, implementation, test result and remaining limitation. | Encryption or consent listed without testing the actual implementation. |
| Conclusion and follow-up | Reasoned outcome, unresolved matters, accountable decision and reassessment conditions. | 'Compliant' while material facts or controls remain undecided. |
An assessment and an audit answer different questions
Article 54 concerns regular compliance audits; Articles 55–56 concern prior assessment of specified processing activities. The 2025 audit guidelines themselves ask whether prior assessments were performed for activities such as entrustment and automated decision-making. An auditor may therefore examine the assessment and its supporting facts, but the audit does not retrospectively replace the prior assessment.
| Dimension | Impact assessment | Compliance audit |
|---|---|---|
| Main question | Is this defined activity justified and are its risks adequately controlled? | Do the processing activities and controls actually comply with applicable rules? |
| Timing | Before Article 55 activities; revisit material factual changes and applicable specific rules. | Periodically, or under a competent authority's specific requirement. |
| Main output | Assessment report and processing records, with reasons and evidence. | Evidence-based findings, a compliance evaluation and remediation follow-up. |
| Evidence reuse | May use tested controls and audit findings, after checking that they fit the proposed activity. | May inspect PIPIA records and test whether promised safeguards are operating. |
Apply the 2026 simplifications narrowly
The final small-processor rules took effect on 1 September 2026. Article 2 defines the covered domestic processor by processing personal information of fewer than 100,000 people; this is not an employee-count or revenue test. Article 14 permits the attached simplified impact-assessment form and requires keeping it for at least three years. That is a simplified method, not a blanket removal of the need to consider the processing activity.
Article 8 provides a separate, conditional non-duplication arrangement for platform-dependent processing: the processor operates only through the platform, the other specified conditions hold, and the platform's assessment actually covers that activity. An off-platform export or a new purpose outside the platform rules cannot simply borrow that coverage. Article 17's certification-related audit relief should not be silently extended to impact assessments.
Example: a supplier adds candidate ranking
Hypothetical example, not a client case: an employer plans to send application data to a service that will rank candidates. First distinguish the employer's decisions from the supplier's role, and identify automated decision-making, entrustment and any overseas access. The presence of more than one trigger does not justify producing several inconsistent descriptions of the same activity.
Document the fields and scoring inputs, why the ranking is needed, how an individual can obtain review, access limits and deletion behavior. If the supplier cannot explain onward access or the proposed safeguards are not implemented, record that gap rather than mark the control as effective. Separately resolve any transfer mechanism; an assessment does not itself grant export permission.
A later audit can sample completed hiring decisions, challenge-handling records and deletion logs against the assessment's commitments. This makes the original assessment operationally useful: it states what was expected and supplies a basis for checking what actually happened.
Keep evidence, not an unnecessary second database
Article 56 requires assessment reports and processing records to be kept for at least three years. Keep versioned decisions, scope, source facts, test results and responsible owners. Do not treat that rule as an instruction to copy every underlying customer record into the assessment file; minimize and protect personal information in the evidence set.
When the purpose, data, recipients or safeguards change, compare the change against the last assessed facts and applicable special rules. An unchanged file name or a recent signature does not establish that an old assessment covers a new activity.
Official sources & revisions
- PIPL Articles 54–56: regular audits, prior impact assessment and records
- 2025 Compliance Audit Measures, Articles 2–15, 19–20 and the audit guidelines
- MOFCOM official republication of the 2026 small-processor rules: Articles 2, 8, 13–14, 17, 21–22
: Replaced repetitive overview copy with a statutory-trigger matrix, evidence structure, assessment/audit comparison, 2026 small-processor limits and a hypothetical candidate-ranking case.
Examples and working tables are original research aids, not official forms or legal advice.
Suggest a correction