China Personal Information Protection Law (PIPL) 21: Art. 21 Entrusted processing: written agreement, supervision, no processing beyond the agreement, return or deletion, no sub-entrustment without consent

A processor entrusting processing must agree with the entrusted party the purposes, period and means of processing, the categories of information, the protection measures and both parties' rights and obligations, and must supervise the entrusted party's processing; the entrusted party processes only as agreed and not beyond the agreed purposes, means and conditions, returns or deletes the information if the entrustment contract does not take effect, is invalid, revoked or terminated, retaining none, and may not sub-entrust processing without the processor's consent.