(Adopted at the 30th meeting of the Standing Committee of the 13th National People's Congress on August 20, 2021)

Chapter 1 General Provisions

Article 1 To protect the rights and interests of personal information，Regulate personal information processing activities，Promote the reasonable use of personal information，According to the Constitution，Enact this law。

Article 2 Personal information of natural persons is protected by law，Any organization、Individuals shall not infringe upon the personal information rights and interests of natural persons。

Article 3 Activities of processing personal information of natural persons within the territory of the People’s Republic of China，This law applies。

Activities outside the territory of the People’s Republic of China that process the personal information of natural persons within the territory of the People’s Republic of China，Any of the following situations，This law also applies:

(1) For the purpose of providing products or services to domestic natural persons；

(2) Analyze and evaluate the behavior of natural persons within the territory;

(3) Other situations stipulated in laws and administrative regulations.

Article 4 Personal information is various information related to an identified or identifiable natural person recorded electronically or by other means，Excluding anonymized information。

The processing of personal information includes the collection of personal information、Storage、Use、Processing、Transmission、Provided、Public、Delete etc.。

Article 5 Personal information should be processed in accordance with law、Legitimate、Principles of necessity and good faith，Do not mislead、Fraud、Processing personal information through coercion and other methods。

Article 6 The handling of personal information should be clear、Reasonable purpose，and shall be directly related to the purposes of processing，Adopt the method that has the least impact on personal rights。

Collect personal information，Should be limited to the minimum scope necessary to achieve the purpose of processing，Do not collect excessive personal information。

Article 7 The handling of personal information shall comply with disclosure、Principle of transparency，Disclosure of Personal Information Processing Rules，Explicit purpose of processing、Method and scope。

Article 8 The quality of personal information shall be ensured when processing personal information，Avoid inaccurate personal information、Incompleteness adversely affects personal rights and interests。

Article 9 Personal information processors shall be responsible for their personal information processing activities，And take necessary measures to ensure the security of the personal information processed。

Article 10 Any organization、Individuals are not allowed to collect illegally、Use、Processing、Transfer other people’s personal information，No illegal trading、Provide or disclose other people’s personal information；Not allowed to engage in activities that endanger national security、Personal information processing activities in the public interest。

Article 11 The state establishes and improves the personal information protection system，Preventing and punishing behaviors that infringe on personal information rights，Strengthen publicity and education on personal information protection，Promote the formation of a government、Enterprise、Related social organizations、A good environment for the public to participate in the protection of personal information。

Article 12 The state actively participates in the formulation of international rules for personal information protection，Promote international exchanges and cooperation in personal information protection，Promote with other countries、Region、Personal information protection rules among international organizations、Mutual recognition of standards, etc.。

　　Chapter 2 Personal Information Processing Rules

　Section 1 General Provisions

Article 13 Those who meet one of the following circumstances，Only the personal information processor can process personal information:

(1) Obtain the consent of the individual;

(2) To conclude、Necessary for the performance of a contract to which the individual is a party，Or it is necessary to implement human resources management in accordance with the labor rules and regulations formulated in accordance with the law and the collective contract signed in accordance with the law；

(3) Necessary to perform legal duties or legal obligations；

(4) In response to public health emergencies，Or necessary to protect the life, health and property safety of natural persons in emergency situations；

(5) Implementing news reports for the public interest、Public opinion supervision and other behaviors，Process personal information within reasonable scope；

(6) In accordance with the provisions of this Law, the personal information disclosed by the individual or other information that has been legally disclosed shall be processed within a reasonable scope；

(7) Other situations stipulated in laws and administrative regulations.

In accordance with other relevant provisions of this law，Personal consent must be obtained for processing personal information，However, if there are circumstances specified in items 2 to 7 of the preceding paragraph，No personal consent required。

Article 14 Processing of personal information based on individual consent，The consent should be voluntary and fully informed by the individual、Explicitly made。Law、Administrative regulations stipulate that the processing of personal information must obtain individual consent or written consent，Subject to its regulations。

Purpose of processing personal information、Changes in processing methods and types of personal information processed，Individual consent should be obtained again。

Article 15 Processing of personal information based on individual consent，The right of individuals to withdraw their consent。Personal information processors should provide convenient ways to withdraw consent。

Individual withdrawal of consent，Does not affect the effectiveness of personal information processing activities based on personal consent before withdrawal。

Article 16 Personal information processors shall not use the grounds that individuals do not agree to process their personal information or withdraw their consent，Refuse to provide products or services；Except when processing personal information is necessary to provide products or services。

Article 17 Personal information processor before processing personal information，Should be in a conspicuous manner、Clear and understandable language is true、Accurate、Inform the individual fully of the following:

(1) Name or name and contact information of the personal information processor；

(2) Purpose of processing personal information、Processing method，Types of personal information processed、Storage period；

(3) Methods and procedures for individuals to exercise their rights stipulated in this law；

(4) Law、Other matters that should be notified according to administrative regulations。

Changes to the matters stipulated in the preceding paragraph，The individual should be informed of the changes。

Personal information processor notifies the matters specified in paragraph 1 by formulating personal information processing rules，Processing rules should be made public，And easy to view and save。

Article 18 Personal information processing by personal information processor，There is a law、Situations that administrative regulations stipulate should be kept confidential or do not require disclosure，It is not necessary to inform individuals of the matters specified in paragraph 1 of the preceding article。

In case of emergency, in order to protect the life, health and property safety of natural persons, it is impossible to notify the individual in time，Personal information processors shall promptly notify the emergency situation after it is eliminated。

Article 19 Except for Laws、Unless otherwise provided by administrative regulations，Personal information shall be retained for the minimum period necessary to achieve the purpose of processing。

m88 online sports betting appm88 best betting websiteArticle 20 Two or more personal information processors jointly decide the purpose and method of processing personal information，Respective rights and obligations should be agreed upon。But，This agreement does not affect an individual’s right to request any of the personal information processors to exercise their rights under this law。

Personal information processors jointly process personal information，Infringement of personal information rights and interests causing damage，Should bear joint and several liability in accordance with the law。

Article 21 Personal information processor entrusted to process personal information，The purpose of the entrusted processing should be agreed with the trustee、Expiration、Processing method、Types of personal information、Protection measures and the rights and obligations of both parties, etc.，And supervise the personal information processing activities of the trustee。

The trustee shall handle personal information in accordance with the agreement，Shall not exceed the agreed processing purposes、Processing methods and other processing of personal information；The commission contract does not take effect、Invalid、Revoked or terminated，The trustee shall return the personal information to the personal information processor or delete it，Not to be retained。

Without the consent of the personal information processor，The trustee shall not entrust others to process personal information。

Article 22 Personal information processor due to merger、Separation、Disbanded、Need to transfer personal information due to bankruptcy or other reasons，The individual should be informed of the name or name and contact information of the recipient。The receiving party shall continue to perform its obligations as a personal information processor。The recipient changes the original processing purpose、Processing method，Individual consent shall be obtained again in accordance with the provisions of this law。

Article 23 Personal information processors provide personal information processed by them to other personal information processors，The individual should be informed of the name of the recipient、Contact information、Purpose of processing、Processing methods and types of personal information，And obtain the individual’s separate consent。The receiving party shall use the above processing purposes、Process personal information within the scope of processing methods and types of personal information。The recipient changes the original processing purpose、Processing method，Individual consent shall be obtained again in accordance with the provisions of this law。

Article 24 Personal information processors use personal information to make automated decisions，Transparency of decision-making and fairness of results should be ensured、Justice，No unreasonable differential treatment shall be imposed on individuals in terms of transaction prices and other transaction conditions。

Pushing information to individuals through automated decision-making、Business Marketing，should also provide options that are not specific to their personal characteristics，Or provide individuals with a convenient way to refuse。

Make decisions that have a significant impact on personal rights through automated decision-making，Individuals have the right to request explanations from personal information processors，And the right to object to personal information processors making decisions solely through automated decision-making。

Article 25 Personal information processors shall not disclose the personal information they process，Except for obtaining individual consent。

Article 26 Installation of image collection in public places、Personal identification device，Should be necessary to maintain public safety，Comply with relevant national regulations，And set a prominent reminder mark。Personal images collected、Identification information can only be used for the purpose of maintaining public safety，Not for other purposes；Except for obtaining individual consent。

Article 27 Personal information processors may process personal information disclosed by individuals themselves or other personal information that has been legally disclosed within a reasonable scope；Except for those who expressly refuse。Personal information processor processes disclosed personal information，Having a significant impact on personal rights and interests，Individual consent shall be obtained in accordance with the provisions of this law。

　　Section 2 Rules for Handling Sensitive Personal Information

Article 28 Once sensitive personal information is leaked or used illegally，It is easy to cause the personal dignity or personal injury of natural persons to be infringed、Personal information whose property security is endangered，includes biometrics、Religious beliefs、Specific identity、Medical Health、Financial Account、Travel and other information，And personal information of minors under the age of fourteen。

Only when there is a specific purpose and sufficient necessity，When strict protective measures are taken，Only personal information processors can process sensitive personal information。

Article 29 The processing of sensitive personal information shall require the individual’s separate consent；Law、Administrative regulations stipulate that written consent must be obtained for processing sensitive personal information，Subject to its regulations。

Article 30 Personal information processor handles sensitive personal information，Except for the matters stipulated in Paragraph 1 of Article 17 of this Law，Individuals should also be informed of the necessity of processing sensitive personal information and the impact on personal rights；Except for cases where notification to individuals is not required in accordance with the provisions of this law。

Article 31 Personal information processors handle personal information of minors under the age of fourteen，The consent of the minor’s parents or other guardians must be obtained。

Personal information processor handles personal information of minors under the age of fourteen，Special personal information processing rules should be formulated。

Article 32 Law、Administrative regulations stipulate that the processing of sensitive personal information requires obtaining relevant administrative licenses or imposing other restrictions，Subject to its regulations。

Section 3 Special Regulations on the Processing of Personal Information by State Agencies

Article 33 Activities of National Agencies Processing Personal Information，This law applies；There are special provisions in this section，The provisions of this section apply。

Article 34: State agencies process personal information to perform legal duties，Should be in accordance with the law、Permissions stipulated in administrative regulations、Procedure in progress，Shall not exceed the scope and limits necessary to perform legal duties。

Article 35: State agencies process personal information to perform legal duties，Should perform notification obligations in accordance with the provisions of this law；Situations specified in paragraph 1 of Article 18 of this Law，Except for those that will hinder the performance of statutory duties by state agencies。

Article 36 Personal information processed by state agencies shall be stored within the territory of the People’s Republic of China；Really need to provide overseas，A security assessment should be conducted。Safety assessment can require support and assistance from relevant departments。

Article 37 Law、Organizations authorized by regulations with the function of managing public affairs process personal information to perform legal duties，The provisions of this law on the processing of personal information by state agencies shall apply。

Chapter 3 Rules for cross-border provision of personal information

Article 38 Personal information processor’s business needs，Those who really need to provide personal information outside the People’s Republic of China，Should meet one of the following conditions:

(1) Pass the security assessment organized by the national cyberspace department in accordance with the provisions of Article 40 of this Law；

(2) Personal information protection certification by a professional organization in accordance with the regulations of the national cyberspace department；

(3) Enter into a contract with the overseas recipient in accordance with the standard contract formulated by the national cybersecurity and informatization department，Agreement on the rights and obligations of both parties；

(4) Law、Administrative regulations or other conditions stipulated by the national cyberspace department。

International treaties concluded or acceded to by the People's Republic of China、The agreement stipulates the conditions for providing personal information outside the territory of the People’s Republic of China，Can be implemented in accordance with its regulations。

Personal information processors should take m88 live casino and sports bettingm88 slot machine casinonecessary measures，Ensure that the overseas recipient’s personal information processing activities meet the personal information protection standards stipulated in this law。

Article 39 Personal information processors provide personal information outside the territory of the People’s Republic of China，The name of the overseas recipient shall be informed to the individual、Contact information、Purpose of processing、Processing method、Types of personal information and matters such as the methods and procedures for individuals to exercise their rights stipulated in this law to overseas recipients，And obtain the individual’s separate consent。

Article 40 Critical information infrastructure operators and personal information processors that handle the amount of personal information required by the national cyberspace department，Personal information collected and generated within the territory of the People’s Republic of China shall be stored within the territory of the People’s Republic of China。Really need to provide overseas，Should pass the security assessment organized by the national cyberspace department；Law、Administrative regulations and national cybersecurity and informatization departments stipulate that security assessment may not be conducted，Subject to its regulations。

Article 41 International treaties concluded or acceded to by the competent authorities of the People’s Republic of China and the People’s Republic of China in accordance with relevant laws、Agreement，Or in accordance with the principle of equality and reciprocity，Processing requests from foreign judicial or law enforcement agencies for the provision of personal information stored within the country。Not approved by the competent authority of the People’s Republic of China，Personal information processors shall not provide personal information stored within the territory of the People's Republic of China to foreign judicial or law enforcement agencies。

Article 42 Overseas Organizations、Individuals engaged in infringement of the personal information rights of citizens of the People's Republic of China，Or endanger the national security of the People’s Republic of China、Personal information processing activities in the public interest，The national cybersecurity and informatization department may include it in the list of restrictions or prohibitions on the provision of personal information，Announcement，And take measures such as restricting or prohibiting the provision of personal information to them。

Article 43 Any country or region prohibits any country or region from adopting discriminatory measures against the People’s Republic of China in terms of personal information protection、Restrictions or other similar measures，The People’s Republic of China may take reciprocal measures against the country or region based on the actual situation。

　Chapter 4 Individual Rights in Personal Information Processing Activities

Article 44 Individuals have the right to know the processing of their personal information、Right of decision，The right to restrict or refuse others to process their personal information；Law、Except otherwise provided by administrative regulations。

Article 45 Individuals have the right to consult the personal information processor、Copy their personal information；With the first paragraph of Article 18 of this Law、Except for the circumstances specified in Article 35。

Personal request to view、Copied his personal information，Personal information processors shall provide it in a timely manner。

An individual requests that personal information be transferred to his or her designated personal information processor，Meet the conditions specified by the national cyberspace department，Personal information processors should provide a means for transfer。

Article 46: Individuals discover that their personal information is inaccurate or incomplete，Right to request corrections from personal information processors、Supplement。

Personal request for correction、Supplement their personal information，Personal information processors should verify their personal information，And correct it in time、Supplement。

Article 47 Under any of the following circumstances，Personal information processors should proactively delete personal information；Personal information processor has not deleted，Individuals have the right to request deletion:

(1) The purpose of processing has been achieved、Not possible or no longer necessary to achieve the purposes of processing；

(2) Personal information processor stops providing products or services，Or the storage period has expired；

(3) Individual withdraws consent;

(4) Personal information processors violate the law、Processing personal information in violation of administrative regulations or agreement；

(5) Other situations stipulated in laws and administrative regulations.

Law、The retention period stipulated in administrative regulations has not expired，Or it is technically difficult to delete personal information，Personal information processors should stop processing other than storing and taking necessary security protection measures。

Article 48 Individuals have the right to request personal information processors to explain their personal information processing rules。

Article 49 Death of a natural person，For their own legality、Legitimate interests，You can exercise access to the relevant personal information of the deceased as stipulated in this chapter、Copy、Correction、Deletion and other rights；Except if the deceased had other arrangements before his death。

Article 50 Personal information processors shall establish a convenient application acceptance and processing mechanism for individuals to exercise their rights。Rejection of an individual’s request to exercise rights，The reason should be stated。

Personal information processor refuses an individual’s request to exercise rights，Individuals can file lawsuits in the People’s Court in accordance with the law。

　　Chapter 5 Obligations of Personal Information Processors

Article 51 Personal information processors shall process personal information according to the purposes for which it is processed、Processing method、Types of personal information and impact on personal rights、Possible security risks, etc.，Take the following measures to ensure that personal information processing activities comply with the law、Provisions of administrative regulations，And prevent unauthorized access and leakage of personal information、Tampering、Lost:

(1) Formulate internal management systems and operating procedures;

(2) Implement classified management of personal information;

(3) Adopt corresponding encryption、De-identification and other security technical measures；

(4) Reasonably determine the operating authority for personal information processing，And regularly provide safety education and training to employees；

(5) Formulate and organize the implementation of personal information security incident emergency plans；

(6) Other measures prescribed by laws and administrative regulations.

Article 52: Personal information processors that handle the amount of personal information required by the national cybersecurity and informatization department shall designate a person in charge of personal information protection，Responsible for supervising personal information processing activities and protective measures taken。

Personal information processors should disclose the contact information of the person in charge of personal information protection，The name of the person in charge of personal information protection、Contact information, etc. shall be submitted to the department that performs personal information protection duties。

Article 53 Personal information processors outside the People’s Republic of China as specified in Paragraph 2 of Article 3 of this Law，Specialized agencies or designated representatives should be established within the territory of the People’s Republic of China，Responsible for handling matters related to personal information protection，Please provide the name of the relevant organization or representative、Contact information, etc. shall be submitted to the department that performs personal information protection duties。

Article 54 Personal information processors shall regularly comply with the law regarding their processing of personal information、Compliance audit for administrative regulations。

Article 55 Any of the following circumstances，Personal information processors should conduct personal information protection impact assessment in advance，And record the processing situation:

(1) Processing of sensitive personal information;

(2) Using personal information for automated decision-making;

(3) Entrusted processing of personal information、Providing personal information to other personal information processors、Public personal information；

(4) Providing personal information overseas;

(5) Other personal information processing activities that have a significant impact on personal rights and interests。

Article 56 Personal information protection impact assessment shall include the following contents:

(1) Purpose of processing personal information、Is the processing method legal、Legitimate、Required；

(2) Impact on personal rights and security risks;

(3) Whether the protective measures taken are legal、Effective and appropriate to the level of risk。

Personal information protection impact assessment reports and processing records should be kept for at least three years。

Article 57 Personal information leakage occurs or may occur、Tampering、Lost，Personal information processors should take immediate remedial measures，And notify the departments and individuals who perform personal information protection responsibilities。The notice shall include the following matters:

(1) Personal information leakage occurs or may occur、Tampering、Type of m88 slot machine casinoinformation lost、Causes and possible harm；

m88 online betting(2) Remedial measures taken by personal information processors and measures that individuals can take to mitigate harm；

(3) Contact information of the personal information processor.

Personal information processors can take measures to effectively avoid information leakage、Tampering、Lost causing harm，Personal information processors may not notify individuals；Departments performing personal information protection responsibilities believe that it may cause harm，The right to require personal information processors to notify individuals。

Article 58 Provision of important Internet platform services、Huge number of users、Personal information processors with complex business types，Should fulfill the following obligations:

(1) Establish and improve the personal information protection compliance system in accordance with national regulations，Establish an independent organization composed mainly of external members to supervise the protection of personal information；

(2) Follow disclosure、Fair、The principle of justice，Make platform rules，Clear the standards for handling personal information and the obligations of product or service providers within the platform to protect personal information；

(3) For serious violations of the law、Product or service provider within the platform that handles personal information under administrative regulations，Stop providing service；

(4) Regularly publish social responsibility reports on personal information protection，Accept social supervision。

Article 59 Trustees entrusted to process personal information，Should be in accordance with this law and relevant laws、Provisions of administrative regulations，Take necessary measures to ensure the security of the personal information processed，And assist personal information processors in fulfilling their obligations under this law。

　Chapter 6 Departments performing personal information protection responsibilities

Article 60: The national cybersecurity and informatization department is responsible for coordinating personal information protection work and related supervision and management work。Relevant departments of the State Council shall comply with this Law and relevant laws、Provisions of administrative regulations，Responsible for personal information protection and supervision and management within their respective scope of responsibilities。

Personal information protection and supervision and management responsibilities of relevant departments of local people’s governments at or above the county level，Determined in accordance with relevant national regulations。

The departments specified in the first two paragraphs are collectively referred to as the departments that perform personal information protection responsibilities。

Article 61 The departments performing personal information protection responsibilities shall perform the following personal information protection responsibilities:

(1) Carry out publicity and education on personal information protection，Guidance、Supervise personal information processors to carry out personal information protection work；

(2) Accept、Handling complaints related to personal information protection、Report；

(3) Organize and evaluate the protection of personal information such as applications，And announce the evaluation results；

(4) Investigation、Processing illegal personal information processing activities；

(5) Other duties stipulated in laws and administrative regulations.

Article 62 The national cybersecurity and informatization department shall coordinate and coordinate relevant departments to promote the following personal information protection work in accordance with this law:

(1) Formulate specific rules for personal information protection、Standard；

(2) For small personal information processors、Processing sensitive personal information and facial recognition、New technologies such as artificial intelligence、New application，Develop special personal information protection rules、Standard；

(3) Support research, development and promotion of application security、Convenient electronic identity authentication technology，Promote the construction of public services for network identity authentication；

(4) Promote the construction of a socialized service system for personal information protection，Support relevant institutions to conduct personal information protection assessment、Authentication Service；

(5) Improve personal information protection complaints、Reporting working mechanism。

Article 63: Departments that perform personal information protection responsibilities perform personal information protection responsibilities，The following measures can be taken:

(1) Ask the relevant parties，Investigating circumstances related to personal information processing activities；

(2) Check、Copy the contract between the parties and personal information processing activities、Record、Account books and other relevant information；

(3) Implement on-site inspection，Investigating suspected illegal personal information processing activities；

(4) Inspection of equipment related to personal information processing activities、item；For equipment with evidence that it is used for illegal personal information processing activities、item，Send a written report to the person in charge of the department and obtain approval，Can be seized or detained。

Departments that perform personal information protection duties perform their duties in accordance with the law，The parties concerned shall provide assistance、Cooperation，Do not refuse、Obstruction。

Article 64: Departments performing personal information protection duties are performing their duties，Discover that there is a greater risk in personal information processing activities or a personal information security incident occurs，The legal representative or principal responsible person of the personal information processor can be interviewed in accordance with the prescribed authority and procedures，Or require personal information processors to entrust a professional organization to conduct compliance audits of their personal information processing activities。Personal information processors should take measures as required，Correction，Eliminate hidden dangers。

The departments that perform personal information protection duties are performing their duties，Discovered illegal processing of personal information suspected of committing a crime，Should be promptly transferred to the public security organs for handling according to law。

Article 65 Any organization、Individuals have the right to complain about illegal personal information processing activities to the department that performs personal information protection duties、Report。Complaint received、The reporting department shall handle it promptly in accordance with the law，And inform the complaint of the result、Informer。

Departments that perform personal information protection responsibilities should announce the acceptance of complaints、Contact information for reporting。

Chapter 7 Legal Liability

Article 66 Processing personal information in violation of the provisions of this law，Or processing personal information and failing to fulfill the personal information protection obligations stipulated in this law，Ordered to make corrections by the department performing personal information protection duties，Give warning，Confiscation of illegal gains，Apps that illegally process personal information，Ordered to suspend or terminate the provision of services；Refuse to correct，A fine of not more than one million yuan；A fine of not less than RMB 10,000 but not more than RMB 100,000 shall be imposed on the directly responsible person in charge and other directly responsible personnel。

Any illegal act specified in the preceding paragraph，Serious circumstances，Ordered to make corrections by the departments performing personal information protection responsibilities at or above the provincial level，Confiscation of illegal gains，A fine of less than 50 million yuan or less than 5% of the previous year’s turnover，And may be ordered to suspend relevant business or suspend business for rectification、Notify the relevant competent authorities to revoke relevant business licenses or revoke business licenses；A fine of not less than RMB 100,000 but not more than RMB 1,000,000 shall be imposed on the directly responsible person in charge and other directly responsible persons，And may decide to prohibit them from serving as directors of relevant companies within a certain period、Supervisor、Senior managers and persons in charge of personal information protection。

Article 67 Anyone who commits any illegal act specified in this law，In accordance with relevant laws、The provisions of administrative regulations shall be recorded in the credit file，And make it public。

Article 68: State agencies fail to perform their personal information protection obligations stipulated in this law，Ordered to make corrections by the superior authority or the department performing personal information protection responsibilities；The directly responsible person in charge and other directly responsible personnel shall be punished in accordance with the law。

Staff of the department performing personal information protection duties neglected their duties、Abuse of power、Practice for personal gain，Not yet a crime，Punishment according to law。

Article 69 Infringement of personal information rights and interests caused by processing personal information，Personal information processor cannot prove that he is not at fault，Should bear tort liability such as damages。

The liability for damages stipulated in the preceding paragraph shall be determined based on the losses suffered by the individual or the benefits obtained by the personal information processor；It is difficult to determine the losses suffered by individuals and the benefits obtained by personal information processors，Determine the amount of compensation according to the actual situation。

m88 slot machine casinom88 slot machine casinoArticle 70 Personal information processors handle personal information in violation of the provisions of this law，Infringement of the rights and interests of many individuals，People’s Procuratorate、Consumer organizations stipulated by law and organizations determined by the national cybersecurity and informatization department may file lawsuits in the People's Court in accordance with the law。

Article 71 Violation of the provisions of this law，Constituting violations of public security management，Public security management penalties in accordance with the law；Constituting a crime，Pursuing criminal responsibility according to law。

　Chapter 8 Supplementary Provisions

Article 72 Natural persons handle personal information for personal or family affairs，This law does not apply。

Statistics on the implementation of laws by people’s governments at all levels and their relevant departments、Processing of personal information in archives management activities is regulated，The regulations apply。

Article 73 The meaning of the following terms in this Law:

(1) Personal information processor，Refers to the independent decision-making of the purpose of processing in personal information processing activities、Organization of processing methods、Individual。

(2) Automated decision-making，refers to automatic analysis through computer programs、Evaluate personal behavior habits、Hobbies or finances、Health、Credit status, etc.，And carry out decision-making activities。

(3) De-identification，refers to the processing of personal information，A process that renders it impossible to identify a specific natural person without the aid of additional information。

(4) Anonymization，Refers to the process in which personal information is processed so that a specific natural person cannot be identified and cannot be recovered。

Article 74 This Law shall come into effect on November 1, 2021。