A personal information handler entrusting the handling of certain personal information to a party shall reach an agreement with the entrusted party on the purposes, period and means of handling, the categories of personal information to be handled and the protection measures, as well as the rights and obligations of both parties, among others, and shall supervise the personal information handling activities of the entrusted party.
The entrusted party shall handle personal information in accordance with the agreement and may not handle personal information beyond the purposes, means and other conditions as agreed upon. Where the entrustment contract has not taken effect, or is invalid, or is revoked or terminated, the entrusted party shall return the personal information in question to the personal information handler or delete it and shall not retain the personal information.
Without the consent of the personal information handler, the entrusted party may not sub-contract the handling of personal information to any other party.
Related provisions:
Relevant PIPL Compliance Documents
(Subscription Services Required)
- Data handling agreement for handlers entrusting handling
- Data handling agreement for entrusted parties entrusted with handling
- Vendor due diligence questionnaire
- Data handling policy for entrusted parties
For detailed information on XL Law Subscription content, click here or email subscriptions@xllawconsulting.com.