Compliance Guide on Personal Information Protection for SMEs

In the Self-Checklist, we use the most common scenarios of personal information processing in the operation and management of SMEs, human resource management and interactions with customers or users, to demonstrate various personal information processing related matters. It may help SMEs to quickly understand and meet the compliance requirements of PIPL in a cost-efficient way. We recommend the following steps for SMEs to follow in order to be compliant with personal information protection requirements.

Step 1: Fill in the Self-Checklist based on the actual practice of the company. Assess the company’s compliance status by completing the Self-Checklist and understand the basic compliance requirements of the PIPL.

Step 2: Carry out internal compliance review and revision of personal information protection related documents in accordance with the compliance requirements listed in the Self-Checklist. The relevant documents mainly include:

• Rules and Policies: The company shall establish an internal management system for the protection of personal information, which may be established in addition to or included as part of the company’s existing internal management rules and policies(e.g. Employee Handbook). Such rules and policies shall include, at a minimum, rules and procedures for processing personal information, policies of personal information classification and management , rules regarding personal information processing authorisation and access control, and contingency plans for personal information security incidents. In addition, it is recommended that companies specify, as clearly as possible, in their rules and policies the circumstances in which personal information of employees shall be processed in daily operation (e.g. sick leave certificates to be collected for leave management, personal information to be collected for internal investigations on various matters, etc.), in order to ensure that companies have a solid basis supporting the processing of employees’ personal information based on HR management necessity.
• Employment contracts, privacy statements, notices on personal information processing, etc.: companies shall inform individuals truthfully and accurately, in a prominent manner and in clear and understandable language, in the text of employment contracts, privacy statements, notices on personal information processing, etc. of the purpose and method of processing personal information, the type of personal information to be processed, the retention period, the circumstances under which personal information may be shared with third parties, as well as the manner in which individuals may exercise their rights to be informed, to make decisions, to access, to copy, to correct inaccurate or supplement incomplete personal information, etc., as provided for by law.
• Contracts with third parties: where a company cooperates with third parties such as customers or suppliers, and where the processing of personal information of its own or the third parties’ employees or users is involved, it shall, depending on the specific relationship with the third parties (e.g. joint processing, entrusted processing or processing separately, etc.), clearly agree with such third parties on their respective duties and obligations in relation to the protection of personal information, and make clear arrangements for the allocation of liability.

Step 3: Develop a personal information protection impact assessment template and where prior assessment is legally required, optimise the content of the template based on the personal information processing activities involved, comprehensively assess the potential impact of the processing activities on the rights and interests of individuals and the security risks they may contain, and produce a personal information protection impact assessment report. Records of risk assessment reports and processing activities shall be retained for at least three years:

• An assessment should address at least the following issues: whether the purpose and method of processing personal information are legitimate, appropriate and necessary; the impact on individuals and the degree of security risks; and whether the safety and protection measures taken are legitimate, effective and proportionate to the degree of risks.
• Common circumstances where a prior personal information protection impact assessment is required for SMEs include: processing sensitive personal information (e.g. processing sick leave certificates submitted by employees), entrusting the processing of personal information to entrusted processors (e.g. engaging HR service providers to provide payroll and social security payment services), providing personal information to third party personal information processors (e.g. providing insurance companies with employees’ personal information for the purpose of purchasing commercial insurances), disclosing personal information to the public (e.g. disclosing employees’ private mobile phone numbers on the company’s website), and transferring personal information outside of mainland China (e.g. sharing employees’ CVs with foreign affiliates).

Step 4: Regularly train HR and personnel playing a role in personal information processing or management on personal information protection related matters.

On the one hand, it is to make sure that people concerned are clear about the requirements of the PIPL and to reduce the risk of processing personal information in breach of the law; on the other hand, it is to fulfil the statutory obligation to provide trainings and demonstration the company’s effort in taking necessary organisational measures to prevent data breaches.

Step 5: (For cross-border transfer of personal information) individuals shall be fully informed and their separate consent shall be obtained if their personal information will be transferred outside of mainland China. Meanwhile, self-security assessments shall be performed in due course in accordance with the standards set by the Cyberspace Administration of China (“CAC”), and the appropriate route of transferring personal information outside of mainland China shall be selected based on the scale and quantity of the personal information involved. For most SMEs, the most common practice would likely be entering into standard contractual clauses formulated by the CAC with the overseas personal information recipients.

The above are the basic steps we recommend for SMEs to take towards PIPL compliance. Among these steps, the completion of this Self-Checklist should be a good start. Please note that this Self-Checklist is for information purposes only and shall not be treated as legal or professional advice. The completion of this Self-Checklist does not represent a confirmation or endorsement of Bird & Bird on the compliance status of a company’s personal information protection practice.

It is also important to note that the completion of the above steps does not mean that the company’s personal information protection is fully compliant. Compliance should be reflected not only in a company’s systems or documents, but also in the practical process of personal information processing.

Self-Checklist for Personal Information Protection Compliance

Self-Checklist for HR Management

Note:
* “Fully inform” means that the company shall inform individuals truthfully and accurately, in a prominent manner and in clear and understandable language, of the name and contact details of personal information processor, the purpose and method of processing personal information, the type of personal information to be processed, the retention period, and the manner in which individuals exercise their rights, as provided for by law.

Self-Checklist for Interactions With Customers or Users

Note:

*Specific purposes should not be described in general terms or in ambiguous way (e.g. “to enhance the customer experience”, etc.).