China's Personal Information Protection Law requires a prior impact assessment before certain processing: handling sensitive personal information, automated decision-making, entrusting processing or providing data to others, making it public, transferring it abroad, and other processing with a significant impact. The assessment must answer three questions set by Article 56, and the record must be kept for at least three years. This skill writes that assessment for one processing activity.
Write in Simplified Chinese unless asked otherwise. National standards such as GB/T 39335 give more detailed methods, and regulators may expect them; confirm with counsel. This is a working document, not legal advice.
Required Inputs
Ask for these if not provided:
- The processing activity: purpose, data subjects, data items, sources, systems, retention
- Which triggers apply: sensitive personal information (including that of minors under 14), automated decisions, entrusting or sharing, publication, cross-border transfer
- Legal basis under PIPL Article 13 (consent, contract, legal duty and others) and how consent is obtained where needed
- Recipients, processors and their contracts
- Existing security measures
Output Structure
1. Scope and triggers
The activity, and which PIPL Article 55 triggers apply, each with the reason.
2. Article 56 assessment
- lawful, legitimate, and necessary: legal basis for each data item; whether each item is needed for the purpose; whether a less intrusive option exists
- impact on individual rights and interests and security risks: harms to individuals (discrimination, financial loss, reputational harm, physical risk), likelihood and severity
- whether the protection measures are lawful, effective, and commensurate with the degree of risk: notices, separate consent where required, access control, encryption, de-identification, processor contracts, rights handling, incident response
3. Risk register
| Risk | Affected people | Likelihood | Severity | Mitigation | Owner | Residual risk |
4. Conclusion and sign-off
Proceed, proceed with conditions, or do not proceed; the conditions; reviewers; date; and the retention note (keep the assessment and processing records for at least three years).
Quality Checks
- Every applicable Article 55 trigger is identified with its reason
- Each data item has a legal basis and a necessity argument
- Harms are assessed for individuals, not only for the company
- Every risk has a mitigation, an owner and a residual rating
- Separate consent is addressed for sensitive information, sharing, publication and export where required
- The record states it must be kept for at least three years
Anti-Patterns
- Assessing after launch. The law requires the assessment before processing.
- Company risk instead of personal risk. The focus is harm to the individual.
- "All data is necessary". Each item needs its own justification.
- A template with the blanks filled. Assessors look for reasoning specific to the activity.
Example Trigger Phrases
- "We are going to launch facial recognition attendance; help me write a personal information protection impact assessment."
- "Using algorithms to set prices for users, is a PIA required? How should it be written?"
- "Entrusting user data to outsourced customer service, what content should be included in the impact assessment?"
- "Write a PIPL impact assessment for our recommendation engine."