Joint Processing Under PIPL

Joint processing means shared purpose-and-means — a vendor on instructions is entrusted, not joint.

PIPL treats two or more handlers who jointly decide purpose and means as jointly responsible. They should agree their respective rights and duties; individuals may exercise rights against either. This is closer to GDPR joint controllers than to a processor. A group HQ and a China entity that co-design a CRM purpose can be joint or even two handlers. Get the role memo right before you draft the contract. Overseas joint handlers still need a CBDT path if PI leaves the PRC.

The classification screen

4 questions before you choose the route.

This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.

Who decided the purpose?

One party or both.

Purpose

Who picked the means?

Shared architecture vs instruction-only.

Means

Is there an entrusted contract instead?

Resolve the is there an entrusted contract instead question separately before choosing the route.

Vendor

Does PI leave China?

Add SCC/assessment/certification.

Export

Working rule: PIPL treats two or more handlers who jointly decide purpose and means as jointly responsible.

What changes the answer

The signal ledger.

These facts move the question beyond a label and into a product, money-flow and control analysis.

Signal

Ask the operating question

Why it changes the route

Joint by slogan

Did the DPA say ‘joint controllers’ with no shared purpose?

PIPL looks at decisions, not English labels.

Vendor as joint

Is a SaaS called joint to share liability?

Usually entrusted.

Silent HQ

Does HQ set purposes with no China contract?

Handler or joint risk.

Prepare before you escalate

Bring a compact evidence docket—not a pitch deck.

Give a compliance team or counsel the operating facts that reveal the perimeter.

01Role memoWho wrote notice, retention, product purposes.

02ContractJoint-processing clauses vs entrusted clauses.

03Data flowsWhether PI is provided abroad.

Common confusions

Questions people ask before they build.

Short answers for orientation. The right result can change with the service model and current rules.

Can the individual sue either party?

PIPL lets people exercise rights against either joint handler. Contractual allocation does not erase that.

Is a group company always joint?

No. HQ can be a separate handler, a joint handler, or a recipient. Map the decisions.

Primary authorities

Reviewed sources support orientation, not a fact-specific assessment.

PIPL / DSL / CSL (NPC laws database)

Cyberspace Administration of China

Gov.cn policy releases

National laws database (NPC)