China Data Protection Impact Assessment (DPIA) Template for Foreign Companies
Document Reference: CG360-DATA-COMPLIANCE-TOOL-054
Last Updated: July 2026
Jurisdiction: People’s Republic of China
China’s Personal Information Protection Law (PIPL), which took effect on November 1, 2021, requires organizations to conduct a Data Protection Impact Assessment (DPIA) before processing personal information in scenarios that carry high risks to individual rights and interests. For foreign companies operating in China or handling personal information of data subjects located in China, understanding and executing a compliant DPIA is not optional — it is a legal obligation that carries significant penalties for non-compliance, including fines of up to RMB 50 million or 5% of annual revenue.
This template provides a comprehensive, step-by-step DPIA framework tailored specifically for foreign-invested enterprises (FIEs) and multinational corporations that process personal information within China’s regulatory framework. It incorporates requirements from the PIPL, the Cybersecurity Law (CSL), the Data Security Law (DSL), and associated implementing regulations issued by the Cyberspace Administration of China (CAC).
1. Understanding When a DPIA Is Required Under PIPL
Article 55 of the PIPL explicitly mandates a DPIA in the following five circumstances:
- Processing sensitive personal information — including biometric data, financial account information, health data, location data, ethnicity, religious beliefs, and sexual orientation.
- Automated decision-making — using personal information to profile individuals for marketing, credit scoring, employment decisions, or other purposes that significantly affect an individual’s rights.
- Entrusting processing to a third party — engaging a data processor outside your organization to handle personal information.
- Providing personal information to a third party — sharing data with other entities, including affiliates within the same corporate group.
- Cross-border transfer of personal information — transferring data outside mainland China, whether to a parent company, subsidiary, or external vendor.
Additionally, the CAC’s implementing rules and sector-specific regulations (such as those for finance, healthcare, and automobiles) may expand the circumstances requiring a DPIA. Foreign companies should err on the side of conducting a DPIA whenever there is reasonable doubt about whether a processing activity triggers the requirement.
2. DPIA Template Structure
Below is the complete DPIA template structured across eight sections. Each section includes prompts, example responses, and compliance notes specific to the Chinese regulatory context.
Section A: Processing Activity Description
Purpose: Document what personal information is being processed, why, and how.
- Processing Activity Name: [e.g., Employee HR Data Management for China Subsidiary]
- Data Controller: [Legal entity name in China, unified social credit code]
- Data Processor(s): [Names of any third-party processors, including cloud service providers]
- Categories of Data Subjects: [Employees, customers, patients, website visitors, business partners]
- Categories of Personal Information: [List all data fields — name, ID number, phone, address, bank account, biometric data, etc.]
- Sensitive Personal Information: [Yes/No — if yes, specify which categories and the legal basis for processing under Article 28-32 of PIPL]
- Volume of Data Subjects: [Estimated number of individuals affected]
- Processing Period: [Start date to expected end date]
- Data Retention Period: [Specific duration and legal basis for retention]
- Technical Measures Applied: [Encryption, access control, pseudonymization, anonymization, audit logging]
- Organizational Measures Applied: [Data classification policy, access approval workflow, staff training records]
Section B: Necessity and Proportionality Assessment
Purpose: Demonstrate that the processing is necessary for and proportionate to the stated purpose.
- Purpose Specification: [Clearly state the specific, explicit, and legitimate purpose under Article 6 of PIPL]
- Minimum Data Principle: [Explain why each data field is necessary — cannot be achieved with less or anonymized data]
- Alternative Processing Methods Considered: [List alternatives that were evaluated and rejected, with reasons]
- Data Minimization Review: [Confirm that only the minimum data necessary is collected]
- Retention Necessity: [Justify retention period with reference to legal requirements, contractual obligations, or legitimate business needs]
Section C: Cross-Border Transfer Assessment
Purpose: Required when personal information will be transferred outside mainland China.
- Transfer Mechanism: [CAC Security Assessment / Standard Contractual Clauses (SCC) / Certification / Other — specify which applies]
- Recipient Country/Region: [Destination jurisdiction(s)]
- Recipient’s Data Protection Level: [Assessment of whether the recipient jurisdiction provides adequate protection per CAC standards]
- Impact Assessment Date: [Date of most recent cross-border transfer impact assessment]
- Supplementary Measures: [Technical and contractual measures to ensure protection equivalent to PIPL standards]
- Data Subject Consent: [Separate informed consent obtained for cross-border transfer — provide consent form reference]
Section D: Risk Identification and Assessment
Purpose: Identify and assess risks to the rights and interests of data subjects.
| Risk Category | Risk Description | Likelihood | Severity | Risk Level |
|---|---|---|---|---|
| Unauthorized Access | External breach of system perimeter | Medium | High | High |
| Data Leakage via Insider | Employee with authorized access exfiltrates data | Low | High | Medium |
| Cross-Border Data Interception | Data intercepted during transmission | Low | High | Medium |
| Data Inaccuracy | Outdated or incorrect personal data used for decisions | Medium | Medium | Medium |
| Excessive Data Collection | Collecting more data than necessary for stated purpose | Medium | Medium | Medium |
| Consent Management Failure | Failure to obtain or document valid consent | Low | High | Medium |
| Rights Request Non-Compliance | Failure to respond to data subject access/erasure requests | Medium | Medium | Medium |
| Government Access Request | CAC or other authority requests data access | High | Medium | High |
Section E: Risk Mitigation Measures
Purpose: Document measures taken to mitigate identified risks.
- Technical Controls: Encryption at rest (AES-256) and in transit (TLS 1.3), role-based access control (RBAC), multi-factor authentication (MFA), intrusion detection systems, data loss prevention (DLP) tools, audit logging with tamper-proof storage
- Organizational Controls: Data Protection Officer (DPO) appointment, employee data handling training (quarterly), incident response plan with 72-hour notification procedure (per Article 57 of PIPL), periodic internal audits
- Contractual Controls: Data processing agreements with all third-party processors, cross-border transfer agreements incorporating PIPL-standard SCCs, liability allocation for data breaches
- Residual Risk Assessment: [Evaluate whether residual risks after mitigation are acceptable]
- Contingency Plan: [Document steps to be taken if a risk materializes]
Section F: Data Subject Rights Compliance
Purpose: Demonstrate how data subjects can exercise their rights under PIPL.
- Right to Know: Privacy notice provided in Chinese language with clear, plain-language description of processing activities
- Right to Consent/Withdraw Consent: Consent mechanism with granular opt-in/opt-out capability; withdrawal process as easy as giving consent
- Right to Access and Port: Process for responding to data access requests within 30 days (Article 45 PIPL); data export mechanism in commonly used format
- Right to Rectify: Correction procedure for inaccurate or incomplete data
- Right to Erase: Deletion procedure when processing purpose is fulfilled, consent is withdrawn, or data is unlawfully processed (Article 47 PIPL)
- Right to Restrict Processing: Mechanism for data subjects to restrict processing during dispute resolution
- Right to Object: Objection process for automated decision-making and marketing purposes
- Right to Explanation: Process for requesting explanation of automated decision-making logic
Section G: Consultation with the CAC (When Required)
Purpose: Document consultation with the Cyberspace Administration of China where mandatory.
- Consultation Required? [Yes/No — required when residual high risk remains after mitigation, per Article 56 PIPL]
- Consultation Date: [Date of consultation submission]
- CAC Response: [Summary of CAC feedback and any conditions imposed]
- Action Items from Consultation: [Steps taken to address CAC feedback]
- Consultation Outcome: [Approved / Conditional approval / Rejected]
Section H: Review and Approval
Purpose: Document formal approval and schedule periodic review.
- DPIA Prepared By: [Name, title, date]
- DPIA Reviewed By: [Data Protection Officer or designated reviewer, date]
- DPIA Approved By: [Senior management representative, date]
- Next Review Date: [Annual review or within 30 days of any material change to processing activity]
- Version: [Version number and revision history]
- Record Retention: [DPIA records must be retained for at least 3 years after processing ends per Article 56 of PIPL]
3. Special Considerations for Foreign Companies
Foreign companies face unique challenges when conducting DPIAs under Chinese law that domestic companies do not. Understanding these nuances is critical to producing a compliant assessment.
3.1 Corporate Group Data Flows
Many multinational companies operate shared service centers (SSCs) or regional HR hubs that process employee data from multiple countries, including China. Under PIPL, providing personal information to an affiliate — even within the same corporate group — constitutes a separate processing activity that requires independent legal basis and a DPIA if cross-border transfer is involved. The PIPL does not recognize the concept of “group company privilege.” Each entity in China must independently justify its data transfers to overseas affiliates.
3.2 Designating a Local DPO or Representative
Article 52 of PIPL requires organizations that process personal information reaching a threshold set by the CAC to appoint a Data Protection Officer (DPO) in China. While the specific thresholds are still being clarified through implementing regulations, foreign companies processing significant volumes of personal information (generally 1 million+ individuals) or sensitive personal information should proactively designate a local DPO. The DPO’s contact information must be publicly disclosed to data subjects.
3.3 Engaging Chinese Cloud and Service Providers
When foreign companies engage Chinese cloud providers (Alibaba Cloud, Huawei Cloud, Tencent Cloud) or SaaS platforms, the service contract should be reviewed to ensure the provider’s data processing terms align with PIPL requirements. Many Chinese cloud providers offer PIPL-compliant data processing addendums. The DPIA should specifically assess the provider’s data localization guarantees, breach notification procedures, and sub-processor policies.
4. Step-by-Step DPIA Workflow
- Identify the processing activity that triggers the DPIA requirement — consult the five conditions under Article 55 of PIPL.
- Assign responsibility — designate a DPIA lead, typically from the legal/compliance or data privacy team.
- Complete Section A — describe the processing activity in detail, including data flows and system architecture.
- Complete Section B — assess necessity and proportionality of the processing.
- If cross-border transfer is involved, complete Section C — including the separate cross-border transfer impact assessment required by the CAC.
- Complete Section D — identify and assess all risks using the risk matrix.
- Complete Section E — document mitigation measures and calculate residual risk.
- Complete Section F — verify that data subject rights mechanisms are in place and operational.
- Assess whether CAC consultation is needed (Section G) — if residual risk remains high, consult the CAC before proceeding.
- Obtain formal approval (Section H) — sign-off from senior management.
- Archive the DPIA — maintain records for at least 3 years after processing ends.
- Schedule periodic review — conduct annual review or within 30 days of any material change to the processing activity, data flows, or legal/regulatory environment.
5. Common Compliance Gaps and How to Avoid Them
Gap 1: Treating DPIA as a One-Time Exercise
Many foreign companies complete a DPIA during initial setup but never revisit it. PIPL requires that DPIAs be reviewed and updated whenever there is a material change to the processing activity — including changes in scope, purpose, technology, or applicable law. A stale DPIA is functionally equivalent to no DPIA from an enforcement perspective. Set calendar reminders for annual reviews and establish an internal trigger protocol for off-cycle reviews when changes occur.
Gap 2: Failing to Document the Necessity Analysis
The PIPL places strong emphasis on the “minimum necessary” principle (Article 6). DPIAs that simply assert necessity without providing a structured analysis — such as evaluating alternative processing methods or demonstrating that each specific data field is required — are likely to be deemed inadequate during a CAC inspection. Document your analysis even if it seems obvious; what is obvious to you may not be obvious to a regulator.
Gap 3: Overlooking Data Subject Rights Mechanisms
A DPIA that identifies risks to data subject rights but fails to demonstrate that operational mechanisms exist to exercise those rights is incomplete. The DPIA should reference specific procedures — not just policies. For example, rather than stating “data subjects have the right to access their data,” document the specific process: “Data subjects submit access requests via email to privacy@company.cn; the DPO confirms receipt within 3 business days; the data is provided within 30 days in CSV format via secure file transfer.”
Gap 4: Inadequate Cross-Border Transfer Analysis
Cross-border transfers are the highest-risk processing activity for foreign companies and the most scrutinized by the CAC. DPIAs that provide a superficial analysis of the recipient jurisdiction’s data protection level — or that fail to identify supplementary measures — will attract regulatory attention. Conduct a thorough legal review of the recipient jurisdiction’s data protection framework, including its enforcement mechanisms and regulatory cooperation with China.
6. Templates and Additional Resources
To support ongoing compliance, organizations should maintain the following supplementary documentation alongside the DPIA:
- Record of Processing Activities (ROPA): A comprehensive register of all personal information processing activities conducted by the organization in China, updated quarterly.
- Data Mapping Documentation: A data flow diagram showing how personal information moves through the organization, including collection points, storage locations, processing systems, and transfer endpoints.
- Consent Management Records: Documentation of consent mechanisms, including consent forms, withdrawal logs, and audit trails.
- Third-Party Processor Register: A list of all third-party data processors, their processing activities, and the contractual safeguards in place.
- Data Breach Response Plan: A documented incident response plan aligned with Article 57 of PIPL, including the 72-hour notification requirement to the CAC and affected data subjects.
- Training Records: Evidence of employee training on PIPL compliance and data handling procedures.
The template provided in this document serves as a baseline framework. Foreign companies should expand and customize each section based on their specific industry, processing activities, and risk profile. Industries subject to additional data protection regulations — including financial services, healthcare, automotive, and e-commerce — may require supplementary sections addressing sector-specific requirements.
