data processing agreement china

Cross-Border Personal Information Processing Agreement (China PIPL Compliant)

Instructions for Use

• Complete all bracketed information, ensuring that the legal entity names match those registered with the State Administration for Market Regulation (SAMR) where applicable.
• If transferring personal information outside of the People’s Republic of China, ensure you have conducted a mandatory Personal Information Protection Impact Assessment (PIPIA) and confirmed the transfer mechanism (e.g., CAC Standard Contract) is attached.
• Review the scope of processing carefully to ensure it aligns with the "minimum necessity" principle required under the Personal Information Protection Law (PIPL).

Parties and Definitions

This Agreement is entered into by and between: [Data Exporter Name], a company organized and existing under the laws of [Jurisdiction], with its principal place of business at [Full Address] ("Data Exporter"); and [Data Importer Name], a company organized and existing under the laws of [Jurisdiction], with its principal place of business at [Full Address] ("Data Importer").

"Personal Information" shall have the meaning ascribed to it under the PIPL. "Processing" includes the collection, storage, use, processing, transmission, provision, disclosure, and deletion of Personal Information.

Operative Terms

1. Purpose and Scope: Data Importer shall process Personal Information only for the following specific purpose(s): [Describe specific business purpose]. Data Importer shall not process Personal Information beyond what is necessary to achieve these purposes.

2. Compliance with PIPL: Data Importer acknowledges that the Personal Information is subject to the PIPL. Data Importer agrees to maintain technical and organizational measures equivalent to the standards required under Chinese law to protect the security of the Personal Information.

3. Data Subject Rights: Data Importer shall provide reasonable assistance to Data Exporter to enable Data Exporter to respond to requests from data subjects exercising their rights (e.g., right to access, copy, correct, or delete) under the PIPL.

4. Sub-processing: Data Importer shall not disclose or transfer Personal Information to any third-party sub-processor without the prior written consent of Data Exporter. Any authorized sub-processor must be bound by contractual obligations at least as restrictive as those contained herein.

5. Security Incidents: In the event of any unauthorized access, loss, or leakage of Personal Information, Data Importer shall notify Data Exporter without undue delay and cooperate fully in remediation efforts and mandatory reporting to the Cyberspace Administration of China (CAC) if required by law.

6. Term and Termination: This Agreement shall remain in effect for [Number] years or until the completion of the processing activities. Upon termination, Data Importer shall, at the choice of Data Exporter, delete or return all Personal Information unless applicable law requires storage.

7. Cross-Border Transfer: Where Personal Information is transferred out of China, the parties agree to execute the CAC Standard Contract for the Outbound Transfer of Personal Information as required by the relevant implementing regulations.

8. Governing Law and Jurisdiction: This Agreement shall be governed by the laws of [Jurisdiction, e.g., P.R. China]. Any disputes arising hereunder shall be submitted to [Name of Arbitration Commission/Court].

Signature and Acknowledgment

For and on behalf of [Data Exporter Name]: Signature: __________ Printed Name: __________ Title: __________ Date: __________

For and on behalf of [Data Importer Name]: Signature: __________ Printed Name: __________ Title: __________ Date: __________

Legal Disclaimer: This document serves as a general framework for compliance purposes. Laws regarding data privacy are subject to frequent regulatory updates. You must consult with qualified legal counsel specialized in Chinese cybersecurity and privacy laws to ensure your specific operations meet all statutory requirements.