Seven Highlights of China's New Sensitive Personal Information Processing Standard — and What They Mean in Practice

Editor’s Note — DCC.

This brief summarises the DEXC+ column article by Wang Yi (王艺), Zhao Yanming (赵艳明), and Zeng Lingwei (曾令玮) of the Shenzhen Data Exchange, published on the DEXC+ (Data Exchange Compliance+) channel. The subject is GB/T 45574-2025 《数据安全技术敏感个人信息处理安全要求》 (Data Security Technology — Security Requirements for Processing Sensitive Personal Information), a recommended national standard (推荐性国家标准) issued by SAMR and the National Standardisation Administration on 25 April 2025 and entering force on 1 November 2025. The authors are certified DExCOs (Data Exchange Compliance Officers) and partners at Beijing Global (Shenzhen) Law Firm. DCC is running this piece because the standard — nearly two years in the making since the August 2023 draft — converts PIPL’s sensitive personal information obligations from high-level statutory commands into detailed, auditable technical requirements. The TC260 sensitive-PI identification guide (TC260-PG-20244A, published September 2024) laid the definitional groundwork; the new standard builds the compliance architecture on top of it.

The seven highlights below follow the article’s own structure. DCC adds operational notes where the authors’ analysis carries direct implications for overseas counsel. This summary does not reproduce the article’s compliance-suggestion section verbatim; that section is condensed at the end.

Background: two years from draft to standard

The journey began on 9 August 2023 when the TC260 secretariat published a draft for comment (征求意见稿). After nearly two years of revision, the standard emerged in April 2025 with a renamed heading — “数据安全技术” (Data Security Technology) rather than “信息安全技术” (Information Security Technology) — signalling alignment with the Data Security Law framework alongside PIPL. Its stated purpose: clarify the criteria for identifying sensitive personal information (敏感个人信息), provide concrete security requirements for processing activities, and give regulators and third-party assessors a workable reference framework.

Highlight 1 — The scope of sensitive personal information has been recalibrated

The standard’s Annex A revises the categories of sensitive personal information (敏感个人信息), departing from GB/T 35273-2020 《个人信息安全规范》 in several material ways. The taxonomy now tracks PIPL directly: biometric identification, religious belief, specific identity, medical and health, financial accounts, location tracks, personal information of minors under fourteen, and other sensitive personal information.

Several items previously considered sensitive have been removed or narrowed:

Identity documents. ID-card numbers, passport numbers, and similar document numbers are no longer treated categorically as sensitive personal information. The one exception is the photograph on a resident identity card (居民身份证照片), which is specifically listed as sensitive.
Marital history and accommodation information are excluded. The practical result for HR teams: collecting an employee’s marital status or home address in the course of personnel management, and collecting flight, rail, or hotel records during expense reimbursement, is in principle no longer processing sensitive personal information.
Property information. Deposit balances, real estate holdings, transaction records, and consumption records are not listed. However, detailed personal income breakdowns (个人收入明细) are included — meaning that background checks on a job applicant’s previous salary may engage sensitive-PI obligations.
Precise vs. approximate location. The standard draws a hard line between precise location data (精准定位信息) — collected via the device’s GPS/location permission — and coarse location data (粗略位置信息) derived from network addresses. Only precise location data is sensitive. Continuous collection of precise location data can generate location tracks (行踪轨迹), which are sensitive. The “continuous” qualifier (连续性) matters: a single precise fix is not automatically a location track.

Two categories of carved-out exceptions are also introduced. Location tracks collected from specific-occupation workers (外卖员、快递员等) purely for service-fulfilment purposes are not sensitive personal information. Basic physical measurements — weight, height, blood type, blood pressure, lung capacity — are not sensitive provided they are unconnected to disease or medical treatment.

Highlight 2 — Identification of sensitive personal information must be dynamic

The standard emphasises that classification is context-dependent and must be reassessed as processing activities evolve. Two specific principles stand out.

First, aggregation matters. The standard repeats a principle previously established in the financial-sector standard JR/T 0171-2020: multiple items of ordinary personal information, when combined, cross-referenced, or analysed, may together constitute sensitive personal information even if none of the individual items would qualify on its own. The same piece of information may carry different sensitivity levels in different use contexts.

Second, de-identification changes the classification. Once sensitive personal information has been properly de-identified (去标识化), it should be protected as ordinary personal information — not as sensitive personal information. Anonymised information (匿名化处理后) is governed by a different regime entirely. The practical implication: de-identification is not merely a security measure but a genuine reclassification mechanism, with the consequence that correctly de-identified sensitive data falls out of the stricter sensitive-PI obligations.

Where a personal information handler has sufficient grounds and evidence to conclude that the data in question does not meet the harm threshold that triggers the sensitive classification, it may elect not to classify it as sensitive personal information.

Highlight 3 — Large-scale sensitive personal information becomes a marker for important data

Article 5.5 of the standard establishes a bridge that compliance teams need to track: where sensitive personal information reaches a scale threshold that, under applicable sector or national data classification and grading rules, causes it to be designated as important data (重要数据), the handlers must apply the protections applicable to important data. The authors catalogue several existing thresholds in force:

Automotive sector (Automobile Data Security Measures, 试行): personal information involving more than 100,000 individuals qualifies as important data.
Beijing Free Trade Zone data classification reference rules: 10 million individuals’ ordinary personal information, 1 million individuals’ sensitive personal information, or 100,000 individuals’ sensitive financial account, insurance, registered-account, or diagnostic data held by FTZ enterprises qualifies.
Beijing FTZ negative list (2024): diagnostic data in the healthcare sector involving more than 100,000 individuals’ case records, imaging, pathology, blood tests, or genetic tests, and databases of more than 100,000 electronic health records, qualify.
Telecom sector identification guide: 100,000 or more sensitive personal information records, or special-group personal information records, collected or generated by a telecom data handler qualify.

The importance of this linkage for overseas counsel: it means that a company’s sensitive-PI volume is not only a PIPL compliance variable but also a potential important-data trigger with cross-border transfer implications.

Highlight 4 — Industry-specific and group-specific requirements

The standard introduces more granular obligations calibrated to particular industries and vulnerable groups, going beyond the baseline PIPL requirements.

Healthcare (Article 6.4). Sensitive personal information in clinical settings must be managed under a tiered access-control approval mechanism. As a specific example, records on HIV and sexually transmitted diseases should be accessible only to the attending clinical team. Clinical research using sensitive personal information requires de-identification.

Financial services (Article 6.5). De-identification must be implemented at both the front end (client-facing transaction and business-management display screens) and the server side (server-side de-identification in logs and backend systems). The explicit extension to the server side represents a significant step beyond the traditional front-end-only approach. Collection of financial account information must use encryption; storing payment-sensitive information that belongs to another institution (such as another bank’s card password) is prohibited.

Minors under fourteen (Article 6.7). Handlers must publish dedicated rules on minor-PI processing and make them prominently visible. They must provide convenient channels for rights holders to exercise data rights. When verifying a minor’s age, the standard recommends also verifying the guardian’s identity — making parental-verification practice a normative expectation rather than a best-practice option.

Persons with disabilities and religious-group members (Articles 6.2, 6.3). Specific identity information and religious belief information must not be used to construct user profiles or for personalised recommendations. This is a targeted prohibition with direct implications for recommendation-algorithm compliance.

Biometric data. Where biometric information is used for identity verification, an alternative non-biometric method must also be offered simultaneously; biometric verification cannot be set as the default-only path. Original biometric feature data (raw images, video) must be deleted once the processing purpose has been achieved. Scientific research use requires written consent.

Location tracks. Processing of location tracks must not mark positions in areas designated as sensitive by relevant authorities. Separately, the standard provides that if geolocation data collected for another purpose can, in combination with timestamps, be reconstructed into a continuous movement path, it should be protected at the same level as location track data — a significant operational point for apps that accumulate precise location fixes without calling the result “location tracking.”

Highlight 5 — Data-security maturity threshold and scale-triggered obligations

The standard sets a minimum data-security capability floor for all sensitive personal information handlers: no less than Level 3 on the GB/T 37988-2019 《信息安全技术数据安全能力成熟度模型》 (DSMM — Data Security Capability Maturity Model). This raises the compliance bar across the board.

For handlers processing sensitive personal information of more than 100,000 individuals, additional obligations apply:

A designated personal information protection officer (个人信息保护负责人) and oversight body must be appointed, responsible for supervising processing activities and protective measures.
The protection officer must have relevant professional knowledge and management experience in personal information protection, and must hold a management-level position within the organisation.
Security background checks must be conducted on the protection officer and key-role personnel.
In the event of a merger, split, dissolution, or bankruptcy that may affect the security of sensitive personal information, a disposal plan must be prepared and security measures implemented.

These requirements interlock with PIPL Article 52 and Article 12 of the Personal Information Protection Compliance Audit Management Measures (个人信息保护合规审计管理办法), converting those statutory requirements into concrete organisational and personnel standards.

PIPL Article 29 requires that processing sensitive personal information obtain the individual’s separate consent (单独同意). Article 5.4.2 of the standard goes further: in certain circumstances specified by law or regulation — the authors list collection of human genetic resources, querying personal information at a credit reference agency, provision of credit information by lending institutions to other parties, and sharing real-estate transaction information through estate-agency services — written consent (书面同意) is required.

Annex B of the standard provides a model template for obtaining written consent for sensitive personal information processing. The template covers processing purpose, data type, and use; storage location and retention period; individual rights and the channels for exercising them; risk disclosure; and a description of the security measures in place. The authors describe it as a comprehensive and operationally useful guide — practitioners drafting or auditing consent mechanisms for sensitive-PI processing will find it the most immediately actionable part of the standard.

The authors note separately that the Facial Recognition Application Security Management Measures (人脸识别技术应用安全管理办法), in force from 1 June 2025, require handlers to disclose in their filing the quantity and scale of facial information stored and the number of natural persons involved — an obligation that sits alongside and interacts with the standard’s biometric-data requirements.

Highlight 7 — Tightened lifecycle requirements across collection, storage, display, and audit

The standard sets out a matrix of requirements across the full processing lifecycle. The key operational points for each stage:

Collection. The necessity standard applies strictly: if an ordinary-personal-information substitute can achieve the same processing purpose, sensitive personal information must not be collected. Collection should be limited to the period of active use of the relevant business function or service. Separate item-by-item collection by business function or service scenario is required; automated collection via technical means or web scraping is prohibited.

Notice. Notice must be delivered through methods that give the individual prominence — separate pop-ups, SMS, fill-in boxes, animation, dedicated notice screens, or voice announcement. Continuous collection requires periodic or continuous reminder mechanisms.

Consent. Where multiple sensitive personal information processing activities are involved, the handler must provide separate consent mechanisms for each processing purpose and business function — each purpose should be ticked individually by the user. Bundled consent for a single item of sensitive personal information used for multiple purposes is prohibited.

Management and security. Material operations on sensitive personal information — internal sharing, external provision, public disclosure, batch querying, plaintext display, download, and export — must each go through an authorisation and approval process. Sensitive personal information must be stored separately from directly identifiable personal information, with encryption at rest and in transit.

Display. Sensitive personal information shown in any interface must be de-identified by default, and the interface must carry a watermark recording the access subject’s identifier and the time of access.

Audit. Beyond restating the PIPL obligation to conduct personal information protection impact assessments (PIPIAs), the standard requires security audits of processing logs and user permissions at least monthly.

Why overseas counsel should care

PIPL operationalised. GB/T 45574-2025 converts PIPL’s high-level sensitive-PI provisions into testable technical and organisational requirements. Regulators and third-party assessors now have a standard checklist; enforcement findings and audit reports will increasingly cite it. Companies that mapped PIPL compliance only at the statutory level should revisit their gap analysis against this standard.
The important-data linkage is new and significant. The explicit bridge in Article 5.5 — volume of sensitive personal information as a possible important-data trigger — means that a company’s sensitive-PI count is not only a consent-and-minimisation problem but also potentially a data-classification, cross-border-transfer, and security-assessment problem. Teams running cross-border transfer compliance should add this threshold check to their data-mapping exercise.
Sector-specific requirements demand tailored reviews. Healthcare, financial services, and minor-focused products each carry additional layers of obligation. A generic sensitive-PI compliance program is unlikely to satisfy the standard’s sector-specific provisions in Articles 6.2–6.7.
The DSMM Level 3 floor is a material uplift. Organisations that have not benchmarked their data-security capabilities against GB/T 37988-2019 should do so before 1 November 2025. Level 3 represents a formalised, managed capability level with documented processes and measurement mechanisms — not a checkbox exercise.

Compliance starting points

The authors close with five practical recommendations. First, use Annex A as the working identification reference and assess both individual data items and aggregate sensitivity of combined datasets. Second, apply differentiated protections by business context and sector rather than treating everything as identically sensitive. Third, extend the standard’s requirements across the full data lifecycle — collection through deletion — cross-referenced against PIPL and the Network Data Security Management Regulations (网络数据安全管理条例). Fourth, revise user authorisation agreements, privacy policies, and data processing agreements to align notice and consent mechanisms with the standard, using Annex B’s written-consent template as the starting point. Fifth, pursue ISO/IEC 27701 or equivalent certification as a vehicle for systematically improving sensitive-PI management capability and signalling compliance to regulators and counterparties.

DCC sources

Original: 王艺、赵艳明、曾令玮,《DEXC+专栏｜《数据安全技术敏感个人信息处理安全要求》的七大亮点及合规建议》, 深圳数据交易所 DEXC+ 专栏 WeChat Official Account (source).
Standard: GB/T 45574-2025 《数据安全技术敏感个人信息处理安全要求》, issued 25 April 2025, effective 1 November 2025.
PIPL — Personal Information Protection Law, Articles 28–32 (sensitive personal information), Article 52 (protection officer).
TC260 Sensitive-PI Identification Guide (TC260-PG-20244A, September 2024).
GB/T 37988-2019 《信息安全技术数据安全能力成熟度模型》 (DSMM).
GB/T 35273-2020 《信息安全技术个人信息安全规范》 (predecessor standard, for comparison).

This is an editorial summary, not a translation of the Wang Yi, Zhao Yanming, and Zeng Lingwei article. Any simplification, error of emphasis, or editorial extrapolation is DCC’s. Not legal advice.