---
title: "Who Is the 'Data Processor' Under the Three-Rights Framework — NDA's Farm-Equipment Hypothetical"
author: "DCC Editorial"
published: 2026-05-28T00:30:00.000Z
url: https://datacompliancechina.com/posts/nda-data-processor-property-rights-allocation/
description: "NDA's official 政策解读 on the threshold question that every three-rights allocation depends on: who is the 'data processor' and who is the 'information subject'? NDA uses a farm-equipment hypothetical — a farm rents tractor, irrigation, and fertilizer equipment from three different vendors; cultivation data is captured in the process — to work through who collects, who decides processing purposes, and how the property-rights regime balances the data-processor's commercial interest against the information-subject's rights to access copies of relevant data. The piece sketches the basic information-subject vs. data-processor dichotomy that anchors the entire downstream data-element regime, and surfaces the access-to-data right (data portability for commercial entities) that overseas counsel often miss."
tags: ["data-property-rights", "data-twenty", "data-processor", "data-economy", "commentary"]
laws_cited: ["data-foundation-system-opinions", "pipl", "civil-code-personal-info", "data-property-rights-registration-guide-draft"]
domains: ["data-economy", "data-security", "personal-information"]
account: "ndb"
original_title: "政策解读 | 数据处理者的数据产权配置安排"
original_author: "国家数据局 (National Data Administration)"
original_publication: "国家数据局 WeChat Official Account"
original_url: "https://mp.weixin.qq.com/s/O1hmeSC9cSbYDg5-L3mXbA"
source_language: "zh"
---
> *Editor's Note — DCC.*
>
> NDA's [first interpretation in the series](/posts/nda-three-rights-structural-separation/)
> defined the three rights themselves — hold, use, operate. This second
> interpretation tackles the prior question: **who is the "data processor"
> in the first place, and who is the "information subject"?** That
> threshold classification determines who, by default, holds each of the
> three rights.
>
> NDA's hypothetical — a farm renting equipment from three different
> vendors, with cultivation data flowing back to all parties — is doing
> useful work. It separates *generating* data (the farm's activity) from
> *collecting* data (the equipment vendors' systems), and it surfaces
> the under-discussed access-to-data right (information subjects'
> entitlement to obtain copies of relevant data) that is the corporate
> analogue to GDPR data portability.

## The threshold classification

The first NDA interpretation walked through the three property rights — hold, use, operate. Before any allocation question can be answered, however, two prior classifications must be made:

1. **Who is the data processor (数据处理者)?** NDA's working definition, drawn by analogy from the PIPL definition of "personal information processor": *the natural person, legal entity, or unincorporated organization that independently determines the purpose and means of processing data*. In practical language: whoever collects, processes, uses, or maintains the data.
2. **Who is the information subject (信息主体)?** The party *about whom* the information being captured as data relates. Importantly, NDA's "information subject" is **not** limited to natural persons. In the PIPL context the corresponding term — personal-information subject — is a natural person. NDA's broader "information subject" category extends to corporate entities whose business activities give rise to data.

The information subject vs. data processor distinction is the principal axis along which the property-rights regime allocates rights and entitlements.

## NDA's farm-equipment hypothetical

A farm rents equipment from three vendors:

- **Company A** supplies the tilling equipment.
- **Company B** supplies the irrigation equipment.
- **Company C** supplies the fertilizer equipment.

In the course of operations, the equipment captures cultivation data — tilling depth, water flow rates, fertilizer composition, growing-cycle timing, output metrics, etc. The data flows back to whichever party's sensors captured it.

Two parties want to extract analytical value from the cultivation data:

- The **farmer** wants to analyze the cultivation data to improve growing efficiency.
- **Companies A, B, and C** each want to analyze the cultivation data captured by their equipment to improve their product designs.

NDA's question: how do the three rights get allocated?

### Step 1 — Identify the data processor for each data stream

The data processor for each data stream is the party whose system collects, stores, and is in a position to independently determine the purpose and means of processing.

- The data captured by Company A's tilling equipment, flowing to Company A's back-end: Company A is the data processor for that stream.
- Similarly for Companies B and C, each for the data their equipment captures.
- If the farm's own monitoring systems independently capture cultivation data on the farm's servers, the farm is the data processor for that stream.

In NDA's other illustration — the e-commerce platform — the platform captures the transaction data, decides how it's stored and used, and is the data processor; the consumer and merchant transacting on the platform are the information subjects (the parties about whose activity the data is generated).

In a third illustration — a manufacturer purchases industrial equipment from a vendor and authorizes the vendor to remotely capture equipment operational data for remote-O&M (远程运维) purposes — the manufacturer's business activity generates the data; the manufacturer is the information subject, and the vendor (who decides means of processing under the authorization) is the data processor.

### Step 2 — Default rights allocation

The three-rights regime, NDA explains, sits at the intersection of two structural realities:

- **Data could not exist without information subjects.** Without the farm's actual cultivation activity, there is nothing for the equipment to capture.
- **Data could not exist without the data processor's investment.** Labor, capital, and technical expertise are required to build the sensors, store the data, and process it into something useable.

The regime balances these by allocating **the three property rights (hold / use / operate) by default to the data processor**, while preserving for the information subject **the right to obtain or copy** the relevant data on the basis of a civil-law contract.

NDA's articulation:

- **Data processors** — for data they collect or generate in their own business activities, or in business activities they jointly participate in, on a basis that does not violate laws or contract terms — **hold the rights to hold, use, and operate** that data.
- **Information subjects** — under civil-law contractual authorizations to others to collect data generated by their participation — **have the right to obtain or copy and transfer** the relevant data.

So in the farm hypothetical: Companies A, B, and C, as data processors for the streams their equipment captures, hold by default the three property rights to that data. The farm, as the information subject whose cultivation activity generated the data, has by default the right to obtain or copy and transfer the cultivation data from each of Companies A, B, and C.

## The asymmetry: why data processors get more than information subjects

NDA is explicit about why the default allocation favors the data processor.

- **Incentive alignment.** The data processor is the party most motivated to invest in development and commercialization. Allocating the use and operating rights to them aligns the regime with the party best positioned to extract value.
- **Protection focus.** The data processor's interest is economic (deriving income from use). The information subject's interest is closer to privacy and trade-secret protection. Distinct interests warrant distinct protection mechanisms.
- **Existing protection gaps.** Personal-information subjects are already protected by PIPL. Corporate-entity information subjects (the farm in NDA's hypothetical; the merchant on the e-commerce platform; the manufacturer in the industrial-equipment scenario) had no analogous protection framework before the Data 20 Articles. The right to obtain or copy the data **fills that gap** — giving corporate information subjects a defined entitlement they previously lacked.

The third point is the structurally novel one. NDA acknowledges that the relevant practical scenario is the **merchant operating across multiple e-commerce platforms** — the merchant's operating data is fragmented across platforms, the merchant wants to consolidate to optimize its strategy, and historically no clear legal right entitled the merchant to demand consolidated copies. The Data 20 Articles regime now contemplates such a right, exercisable on the basis of a civil-law contract between the information subject and the data processor.

## What this means in transactional vocabulary

The default allocation can be modified by contract. Three contracting patterns are particularly important for overseas counsel.

**Pattern 1 — Allocate use or operating rights to the information subject.** The default is that the data processor holds use and operating rights. But the parties can contract for the information subject to also hold a use right (e.g., the farm gets to use the cultivation data Company A captures), or even an operating right (e.g., the farm gets to commercialize the cultivation data). This is essentially a license-grant in the opposite direction — and is becoming a common term in Chinese supplier-data agreements.

**Pattern 2 — Joint-rights allocation in data-fusion arrangements.** Where multiple parties co-create a derivative data set (e.g., Companies A, B, and C jointly analyze cultivation data with the farm to produce a fused agronomic-optimization data set), the parties can contract for joint holding, joint use, and either joint or single-party operating rights. The first NDA interpretation flagged this as a key mode of arrangement; the second explains why each party has independent contractual standing to negotiate (because each has, in the underlying data, *either* information-subject rights or data-processor rights).

**Pattern 3 — Strengthening the information subject's access entitlement.** Counter-intuitively for overseas counsel familiar with GDPR's "data portability" right, the equivalent right in the Chinese commercial regime is *contractual, not statutory* for non-personal data. To make it enforceable, the parties have to specify it. Information subjects (especially corporate counterparties with significant data generation) increasingly negotiate explicit access, copy, and porting terms into contracts with data processors. Overseas teams contracting with Chinese counterparties as either side of this relationship should expect the right to be a negotiated term, not a baseline.

## How this connects to PIPL

For data containing personal information, the PIPL regime applies in parallel and takes precedence on PI questions. NDA's data-processor allocation regime explicitly references PIPL by analogy when defining "data processor." Two clarifications matter:

- **The PIPL personal-information processor (个人信息处理者) is a subset of NDA's data processor (数据处理者).** The PIPL term applies only where the data being processed is personal information. NDA's broader term extends to all data, including industrial, commercial, and non-PI data.
- **PIPL Article 45 — individual's right to copy and transfer personal information — is the personal-data analogue of the Data 20 Articles' broader "right to obtain or copy" for information subjects.** The Data 20 framework extends the conceptual shape of the Article 45 right beyond personal data and beyond natural-person subjects.

The architecture is becoming clearer with each NDA interpretation: a **PI-centric regime under PIPL** for personal data, layered with a **property-rights-centric regime under the Data 20 Articles** for the broader data-element category, with the two regimes intersecting where data contains personal information.

## What this tells overseas compliance teams

- **Run the data-processor / information-subject classification before any rights allocation.** Both as a counterparty diligence step (for any Chinese data-collaboration arrangement) and internally (to map which Chinese affiliates are processors vs. subjects with respect to which data sets).
- **The default is data-processor-favorable; the contract is where information subjects claw rights back.** Chinese data-supplier contracts should be reviewed for default allocations and explicit information-subject-access terms. Where the multinational is the information subject, the access term is the principal practical lever for retaining control over data generated by its operations.
- **Corporate "data portability" is the underrecognized right in this regime.** Western practice tends to think of data portability as a personal-data right. The Data 20 Articles regime generalizes it to corporate information subjects — and creates a contracting and disputes vector for corporate parties to demand copies of operational data held by their suppliers, platforms, and counterparties. Watch for this to grow into the dominant friction point in Chinese platform-supplier disputes over the next two to three years.

The deeper structural shift: where Western IP and contract law generally treat data as the property of the party that captures and processes it (custodianship plus license), the Chinese regime *acknowledges that the party generating the underlying activity has an equally legitimate claim* and creates a structural entitlement for them to obtain copies. The default still favors the data processor — but the regime is, conceptually, more balanced than the Western default. Overseas counsel structuring Chinese arrangements should price that asymmetry into the deal.

---

— *国家数据局, 政策解读 | 数据处理者的数据产权配置安排 (Policy Interpretation: Property Rights Allocation Arrangements for Data Processors), 国家数据局 WeChat Official Account. [Original article (Chinese).](https://mp.weixin.qq.com/s/O1hmeSC9cSbYDg5-L3mXbA)*

*Not legal advice. The above is DCC's structured summary of NDA's policy interpretation, with framing for overseas counsel; the farm-equipment hypothetical and the e-commerce / industrial-equipment illustrations are NDA's.*