Fundamentals For Managing Employees' Personal Information In China

Personal Information Protection Law (PIPL) was adopted on 1 November last year and applies to all individuals and organisation handling personal data. Since the adoption, regulators have been actively investigating suspected violations and issuing fines. For employers, implementing PIPL compliance measures when processing employees' personal information reduces legal risks. In the below, we provide the fundamentals for managing employees' personal information.

Obtain specific consent when using third parties

Employees' personal information shall not be provided to third parties without consent. During the recruitment, if the enterprise uses a third party to provide recruitment services or conduct a background investigation, the enterprise must obtain the written authorisation of the employee. In other words, the employer shall inform and obtain the consent of the individual, otherwise, the enterprise may infringe on the individual's rights.