Glossary

Sensitive Personal Information (敏感个人信息)

Definition

Sensitive personal information is personal information that, once leaked or illegally used, can easily lead to infringement of a natural person's human dignity or harm to personal or property safety. The definition comes from Article 28 of the Personal Information Protection Law (PIPL).

Article 28 of the PIPL states (Chinese official text, published at npc.gov.cn):

敏感个人信息是一旦泄露或者非法使用，容易导致自然人的人格尊严受到侵害或者人身、财产安全受到危害的个人信息，包括生物识别、宗教信仰、特定身份、医疗健康、金融账户、行踪轨迹等信息，以及不满十四周岁未成年人的个人信息。只有在具有特定的目的和充分的必要性，并采取严格保护措施的情形下，个人信息处理者方可处理敏感个人信息。

Working English rendering (not an official translation): personal information that, once leaked or illegally used, can easily lead to infringement of a natural person's human dignity or harm to personal or property safety — includes biometric, religious-belief, specific-identity, medical-health, financial-account, and whereabouts-tracking information, plus personal information of minors under 14. A processor may process it only where there is a specific purpose and sufficient necessity, with strict protective measures. No official English translation of the PIPL is banked; the Chinese-verbatim-plus-working-English pairing follows the precedent on the cross-border data transfer page.

What counts as sensitive personal information

Article 28 of the PIPL enumerates six categories of sensitive personal information, plus one age-based category. The full statutory list:

Biometric information (生物识别)
Religious-belief information (宗教信仰)
Specific-identity information (特定身份)
Medical-health information (医疗健康)
Financial-account information (金融账户)
Whereabouts-tracking information (行踪轨迹)
Personal information of minors under the age of 14 (不满十四周岁未成年人的个人信息)

The statute writes 等 ("and so on") after the six named categories, and the working English above mirrors that with "includes" — the list is not stated as closed. No implementing catalog is banked on this site: the six categories plus the under-14 rule are everything the statute itself names.

Processing condition: separate consent

Article 29 of the PIPL states (Chinese official text):

处理敏感个人信息应当取得个人的单独同意；法律、行政法规规定处理敏感个人信息应当取得书面同意的，从其规定。

Working English: processing sensitive personal information requires the individual's separate consent. Where laws or administrative regulations require written consent for processing sensitive personal information, those provisions prevail.

Two conditions stack on top of the separate-consent requirement. Article 28's second sentence adds that a processor may process sensitive personal information only where there is a specific purpose and sufficient necessity, with strict protective measures. Article 30 requires the processor to inform the individual of the necessity of the sensitive-PI processing and its impact on the individual's rights — beyond the standard Article 17(1) notice items, and subject to statutory exceptions.

For minors under 14, Article 31 adds a separate layer: the personal information of minors under 14 is sensitive by definition (Art. 28), and processing it requires the consent of the minor's parent or guardian plus dedicated processing rules (Art. 31). Both articles are from the PIPL statute; neither is an Order No.16 provision.

Why sensitive personal information matters for cross-border transfer

The cross-border data transfer page sets out the threshold ladder that determines which Article 38 mechanism applies. Sensitive personal information runs on its own track within that ladder. The key thresholds, as stated on that page:

Security assessment required (Order No.16 Art.7): a non-CIIO processor that has cumulatively transferred sensitive personal information of 10,000 or more individuals since January 1 of the current year.
SCC filing or certification (Order No.16 Art.8): a non-CIIO processor that has transferred non-sensitive personal information of 100,000 or more but fewer than 1,000,000 individuals, or sensitive personal information of fewer than 10,000 individuals, in the current calendar year.
No mechanism required (Order No.16 Art.5, item 4): a non-CIIO processor that has cumulatively transferred personal information of fewer than 100,000 individuals (non-sensitive) since January 1 of the current year. The transferred data must not include important data, and there must be no sensitive personal information in the mix — any sensitive volume counts on the sensitive track above.

The cross-border data transfer page states it directly: "The sensitive and non-sensitive tracks are separate. A processor that has transferred sensitive PI of 10,000 or more individuals triggers the security assessment regardless of where its non-sensitive volume falls." That sentence is the operational rule: sensitive volume counts on its own ladder, and crossing 10,000 sensitive individuals pulls the transfer into the security assessment tier regardless of non-sensitive volume.

Article 39 of the PIPL adds that cross-border provision of personal information requires notice to the individual (recipient name and contact, purpose, method, PI categories, how to exercise rights against the recipient) and separate consent. For sensitive personal information transferred cross-border, both the Article 29 separate-consent condition and the Article 39 cross-border separate-consent condition apply. This page states each article's requirement; it does not rule on whether the two consents collapse into one.

Article 40 of the PIPL requires critical information infrastructure operators and processors whose personal-information volume reaches the prescribed quantity to store mainland-collected and -generated personal information inside the mainland. Cross-border provision from that class passes the security assessment. Whether an operation falls into this class turns on the prescribed thresholds — the data residency page covers the storage-side obligation. For the operational walkthrough of these duties — lawful bases, the defined notice, the separate-consent rules — see our PIPL compliance for foreign companies article.

What this page does not cover

This page defines sensitive personal information under PIPL Article 28, states the processing conditions from Articles 28–31, and points to the cross-border transfer threshold ladder. It does not cover:

Transfer mechanism details. The security assessment procedure, SCC filing steps, certification pathways, and the 2024 exemption tiers are owned by the cross-border data transfer page. This page cites the thresholds; the mechanism page owns the procedure.
General PIPL overview. The statute's full scope, Article 3 extraterritorial reach, the relationship to the Data Security Law and Cybersecurity Law, and the ICP filing boundary — these are owned by the PIPL page.
Implementing rules or sector catalogs. GB/T 35273-style classification tables, CAC sensitive-PI guidance, or sector-specific sensitive-PI catalogs are not banked on this site. This page cites the statute text only.
"Important data" under the Data Security Law. Important data is a separate DSL concept with a separate cross-border assessment trigger. The Data Security Law page owns that term.
Enforcement statistics or fine amounts. Article 66 penalties are not extracted on this site for this term.

Frequently asked questions

What counts as sensitive personal information under PIPL?

Article 28 of the PIPL defines sensitive personal information as personal information that, once leaked or illegally used, can easily lead to infringement of a natural person's human dignity or harm to personal or property safety. The statute enumerates six categories: biometric, religious-belief, specific-identity, medical-health, financial-account, and whereabouts-tracking information. It also includes personal information of minors under the age of 14.

What consent does processing sensitive personal information require?

Article 29 of the PIPL requires the individual's separate consent. Where laws or administrative regulations require written consent for processing sensitive personal information, those provisions prevail. The processor may process sensitive personal information only where there is a specific purpose and sufficient necessity, with strict protective measures (Article 28, second sentence).

How does sensitive personal information affect the cross-border transfer mechanism?

The cross-border transfer threshold ladder treats sensitive and non-sensitive personal information on separate tracks. A non-CIIO processor that has cumulatively transferred sensitive personal information of 10,000 or more individuals since January 1 of the current year must pass the security assessment (Order No.16 Art.7). Below 10,000 sensitive individuals, the transfer falls in the SCC-filing or certification band (Art.8). The sensitive track triggers independently of the non-sensitive volume.

Does the sub-100,000 exemption apply if we transfer sensitive personal information?

No. The Tier 4 volume exemption (Order No.16 Art.5, item 4) applies to non-CIIO processors that have cumulatively transferred personal information of fewer than 100,000 individuals (non-sensitive) since January 1 of the current year, and whose transferred data includes no important data. Any sensitive personal information in the mix removes the exemption — it counts on the sensitive track.

Is sensitive personal information the same as important data under the Data Security Law?

No. Sensitive personal information is a PIPL concept (Article 28) that applies to personal information of natural persons. Important data is a Data Security Law concept that applies to data of any kind. The two trigger different obligations and different cross-border assessment thresholds. The cross-border data transfer page keeps the two concepts separate.

Related terms

PIPL (个人信息保护法) — governs the processing of personal information in the mainland.
Cross-Border Data Transfer in China — the provision of personal information collected inside the mainland to a recipient outside the mainland.
Data Residency in China — the requirement that personal information collected and generated inside the mainland be stored on servers inside the mainland — for a defined class of operators.
Data Security Law (DSL) — China's framework law for data processing; source of the "important data" trigger that feeds the cross-border security assessment.