On August 10, 2023, the National Information Security Standardization Technical Committee (NISSTC) released the Information Security Technology — Security Requirements for Processing of Sensitive Personal Information (Draft for Comment) (the "Draft"), which is open for public comments until October 8, 2023.

The Draft is intended to regulate the activities of personal information processors in handling personal information. It can also serve as a reference for regulatory authorities and third-party assessment organizations to supervise, manage, and assess the personal information processing activities carried out by personal information processors. To comply with the stipulations of the Personal Information Protection Law pertaining to the processing of sensitive personal information, the Draft outlines scenarios involving the processing of sensitive personal information such as biometrics, religious beliefs, specific identities, medical and healthcare, financial accounts, whereabouts and tracks, and information on minors under the age of 14. It clearly sets out the security requirements for data processors engaged in activities related to the collection, storage, use, processing, transmission, provision, disclosure, and deletion of said sensitive personal information, particularly, focusing on specific requirements related to necessity of collection, security protection, and rules of desensitization, informed consent, and more.

(Source: China National Information Security Standardization Technical Committee)