Entrusted Processing Under PIPL

Entrusted processing is instruction-only — if the vendor sets new purposes, it is not entrusted.

When a handler engages a vendor to process PI, PIPL requires an entrusted-processing agreement covering purpose, period, types, protection measures, and the vendor’s duty to return or delete. The vendor must process per instructions and cannot subcontract or change purposes casually. A PIA is typically required before entrusting. If the vendor is overseas, you still need a CBDT tool — the DPA is not an export licence. GDPR processor clauses are a start, not a finish.

The classification screen

4 questions before you choose the route.

This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.

Who is handler vs vendor?

Who decides purpose and means.

Role

Is the contract PIPL-complete?

Purpose, types, period, security, return/delete.

Contract

Is a PIA done?

Entrusting is a listed PIA trigger.

PIA

Does PI leave China?

Then add SCC/assessment/certification.

Export

Working rule: When a handler engages a vendor to process PI, PIPL requires an entrusted-processing agreement covering purpose, period, types, protection measures, and the vendor’s duty to return or delete.

What changes the answer

The signal ledger.

These facts move the question beyond a label and into a product, money-flow and control analysis.

Signal

Ask the operating question

Why it changes the route

DPA-only export

Did you sign a DPA and sync to HQ?

Still an export.

Vendor as handler

Does the SaaS train models on your PI?

That is not entrusted-only.

Sub-processors in the dark

No list, no flow-down.

PIPL expects control of onward entrusted parties.

Prepare before you escalate

Bring a compact evidence docket—not a pitch deck.

Give a compliance team or counsel the operating facts that reveal the perimeter.

01Role memoHandler vs vendor vs joint.

02ContractPIPL-required clauses, not only GDPR Art. 28.

03PIADated assessment of this vendor processing.

Common confusions

Questions people ask before they build.

Short answers for orientation. The right result can change with the service model and current rules.

Is a US DPA enough for a Shanghai vendor?

If both are in the PRC and the vendor only follows instructions, a PIPL entrusted contract is the right instrument — still map the clauses.

Can the vendor keep backups after exit?

Generally return or delete, subject to legal holds. Spell it out.

Primary authorities

Reviewed sources support orientation, not a fact-specific assessment.

PIPL (NPC / official text)

Cyberspace Administration of China

National laws database (NPC)

Gov.cn policy releases