Platform data · 07 Editorial guide
Digital platforms & data compliance
A digital platform is not one processing activity. Account creation, merchant onboarding, search, recommendations, advertising, payments, support, fraud controls, location, content moderation and analytics can involve different purposes, data types, systems and recipients. Start with the live product and data flow, then assign the PIPL and data-security controls feature by feature.
First job Map platform roles, personal-data flows and any cross-border transfer before selecting compliance steps.
Start here
Key considerations
The first questions are about urgency, governance and preservation — before collection expands or interviews begin.
- Which China-facing app, site, mini-program, merchant console or internal platform feature is in scope?
- Which entity determines each processing purpose and method, and which merchants, SDKs, vendors or affiliates receive data?
- Do sensitive personal information, minors, automated decisions, important data or overseas access change the launch gate?
Direct answer
What this page decides
02
The platform operator must classify what each feature actually does with data rather than rely on one privacy policy. Under the PIPL, the entity determining purposes and methods is the personal-information handler; joint handlers must allocate responsibilities, while entrusted processors need documented instructions and security controls. Sensitive information and specified high-risk activities require additional safeguards and impact assessment. Automated decisions must be transparent and fair, must not impose unreasonable differential treatment in transaction terms, and require a non-personalized option or convenient refusal where information push or commercial marketing is involved. Platform products may also trigger app-distribution, algorithm-recommendation, minors, network-data, incident and cross-border rules. The release decision should therefore be tied to a current data map and evidence pack, not a generic policy or vendor assurance.
At a glance
Which fact changes the next route
Use the fact that changes ownership or urgency to decide the next move.
| Question | Why it matters | Next route |
|---|---|---|
| Who determines the purpose and method? | Platform, merchant, affiliate and vendor labels do not by themselves establish handler, joint-handler, recipient or entrusted-processor roles. | Allocate each purpose and decision right, then align contracts, notices, instructions and supervision evidence. |
| What do the app and embedded SDKs collect in practice? | Permissions, device identifiers, logs, location and background transmissions may differ from written disclosures or vendor questionnaires. | Test the released build and each SDK version against the field-level inventory and user journey. |
| Does ranking, recommendation or pricing use personal characteristics? | Automated decisions and algorithm recommendations create transparency, fairness, user-choice and possibly filing or assessment obligations. | Document inputs, labels, purpose, human controls, user options, outcome testing and change history. |
| Can any overseas system or person access the data? | Remote administration, support, analytics and group dashboards can create a cross-border provision even without a bulk database export. | Map recipient, data, purpose and volume before applying exemptions, standard contract, certification or security-assessment rules. |
Scope
What this page owns — and what it does not
Practical workflow
Action, evidence, legal gate, output
| Action | Documents / evidence | Legal gate | Output |
|---|---|---|---|
| Inventory the live product | Feature list, user journeys, screens, permissions, APIs, SDKs, databases and admin access | Complete field-level collection and flow map | Versioned data inventory |
| Classify roles and legal basis | Entity decisions, merchant/vendor functions, notices, consent records and contracts | Handler, joint, entrusted or recipient role for each purpose | Role and lawful-basis matrix |
| Test high-risk features | Sensitive-data uses, minors flow, recommendation/pricing logic, rights interface and impact assessments | Separate consent, assessment, transparency and user-choice controls | Feature risk decisions |
| Review sharing and exports | Recipients, overseas access, volumes, important-data analysis and transfer documents | Domestic sharing control and correct export route or exemption | Recipient and transfer register |
| Approve and monitor release | SDK scan, security test, deletion test, incident playbook, audit evidence and change ticket | No unexplained collection or unowned remediation | Release evidence pack |
Documents
What to gather before the next call
These items help clarify the file; they are not a legal requirement list.
| Item | Why needed | Who holds it | Risk if missing |
|---|---|---|---|
| Feature and data-flow inventory | Connects every field and transfer to a live product purpose | Product, engineering, data and privacy | Policies describe a platform that no longer exists |
| SDK, API and vendor register | Shows code-level collection, recipients, versions, instructions and supervision | Engineering, procurement and security | Third-party collection or onward use is invisible |
| Notice, consent and rights evidence | Proves what users saw, chose and could exercise for each version | Product, customer support and privacy | The interface and legal record cannot substantiate the asserted basis |
| Algorithm and automated-decision file | Records labels, inputs, outputs, fairness tests, user options and material changes | Product, data science and compliance | Opaque personalization or differential treatment cannot be explained or corrected |
| Impact, security, incident and transfer records | Supports high-risk processing, safeguards, response readiness and overseas-access decisions | Privacy, security and relevant business owners | A launch proceeds without the required assessment or export gate |
Common failure points
Where files usually break
Using one privacy policy as a substitute for a field-level product and data-flow inventory.
Calling every merchant or vendor an independent handler without analyzing who determines purpose and method.
Accepting an SDK vendor questionnaire without testing the released code and network behavior.
Bundling necessary and optional collection into one consent or hiding sensitive-information processing in general language.
Treating recommendation, ranking, targeted marketing or personalized pricing as a neutral product feature without automated-decision controls.
Ignoring remote overseas access because no database is physically copied abroad.
Launching a new feature without updating assessments, notices, consent records, deletion logic, incident playbooks and the evidence pack.
Decision map
Keep the question bounded.
- Map features, entities and flowsInventory each user and merchant journey, data field, collection point, system, purpose, legal basis, retention period, recipient, SDK and access location.
- Apply feature-specific gatesTest notices and consent, sensitive information, minors, entrusted or joint processing, automated decisions, user rights, cross-border transfers and sector requirements.
- Prove operation and change controlRetain assessments, contracts, SDK testing, consent records, rights logs, deletion tests, algorithm controls, incident exercises and release approvals for every material version.
Curated resources
Open the asset that matches this job.
No canonical deep guide is assigned yet. Use this route for orientation and continue to local context or qualified counsel.
Helpful to prepare
Facts that make the next conversation clearer.
These items are orientation aids, not a legal requirement list.
Counsel hand-off
What to bring when you instruct
This topic route organises the national legal question. It does not decide rights, strategy, liability, approval outcome or procedural result on the facts. Use qualified PRC counsel where fact-specific advice or representation is required.
Local context
Add the city when regulator practice changes.
Add city or province context only when the responsible authority, court, registration practice, permit process or local implementation changes after the national route is identified.
Open city and province guidesCounsel hand-off
Need data-privacy counsel?
This hub organises PIPL, cybersecurity and export questions. It does not decide whether a transfer is lawful or whether notice is required on your facts.
Find data-privacy counselLegal review
Who reviewed this guide
Subject to editorial/legal review. No reviewer is assigned to this route.
Need qualified counsel?
Move carefully. Move with a record.
Use the portal to identify counsel for this practice and related China-side issues.