China Personal Information Protection Law (PIPL) 51: Art. 51 Security and compliance measures: internal systems, classified management, encryption and de-identification, access authority and training, incident plans

Based on the purposes and means of processing, the categories of information, the impact on individuals and the security risks, a processor must adopt measures ensuring compliance and preventing unauthorised access, leakage, tampering and loss: internal management systems and operating procedures; classified management of personal information; security technical measures such as encryption and de-identification; reasonably determined operating authority and regular security education and training for practitioners; contingency plans for personal information security incidents and their implementation; and other measures law provides.