PIPL Impact Assessment (个人信息保护影响评估)

China's Personal Information Protection Law requires a prior impact assessment before certain processing: handling sensitive personal information, automated decision-making, entrusting processing or providing data to others, making it public, transferring it abroad, and other processing with a significant impact. The assessment must answer three questions set by Article 56, and the record must be kept for at least three years. This skill writes that assessment for one processing activity.

Write in Simplified Chinese unless asked otherwise. National standards such as GB/T 39335 give more detailed methods, and regulators may expect them; confirm with counsel. This is a working document, not legal advice.

Required Inputs

Ask for these if not provided:

• The processing activity: purpose, data subjects, data items, sources, systems, retention
• Which triggers apply: sensitive personal information (including that of minors under 14), automated decisions, entrusting or sharing, publication, cross-border transfer
• Legal basis under PIPL Article 13 (consent, contract, legal duty and others) and how consent is obtained where needed
• Recipients, processors and their contracts
• Existing security measures

Output Structure

1. Scope and triggers

The activity, and which PIPL Article 55 triggers apply, each with the reason.