China Personal Information Protection Law (PIPL) 55-56: Art. 55-56 Personal information protection impact assessment before sensitive, automated, shared, published or cross-border processing, with records kept three years

Before processing sensitive personal information, using personal information for automated decision-making, entrusting processing, providing information to another processor or publishing it, providing information outside China, or any other processing with a significant impact on individuals, a processor must assess in advance the impact on personal information protection and record the processing; the assessment covers whether the purposes and means are lawful, justified and necessary, the impact on individuals' rights and interests and the security risks, and whether the protection measures are lawful, effective and proportionate to the risk; the assessment report and the processing record are kept for at least three years.