Sensitive Personal Information In China

Abstract

This article analyses the definition, regulatory framework, and compliance challenges surrounding Sensitive Personal Information (SPI) under China's Personal Information Protection Law (PIPL) and related standards. For enterprises, accurately identifying SPI within their data ecosystems is critical to the PIPL compliance efforts. Organisations must continually assess risks tied to data practices, particularly amid challenges posed by big data and algorithmic profiling.

The definition of SPI

Sensitive personal information (SPI) in China is defined by Article 28 of the Personal Information Protection Law (PIPL) as:

Sensitive personal information refers to personal information that, once leaked or illegally used, will easily lead to infringement of the human dignity or harm to the personal or property safety of a natural person, including biometric recognition, religious belief, specific identity, medical and health, financial account, personal