Direct answer

The handler decides purpose and means; the entrusted party does not become the handler by hosting servers.

PIPL’s ‘personal information handler’ is the organisation or individual that independently decides the purpose and means of processing. That is closer to a GDPR controller than to a processor. An entrusted processor (vendor) processes per the handler’s instructions under an entrusted-processing contract — see that sibling. Joint processing is a different relationship. Overseas handlers targeting PRC individuals may still be handlers and may need a PRC representative. Do not assume the Chinese WFOE is the only handler if HQ sets the purposes.

The classification screen

4 questions before you choose the route.

This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.

01

Who decided the purpose?

Product, marketing, HR, or a group policy.

Purpose
02

Who picked the tools?

Which vendor and which fields.

Means
03

Is there an entrusted contract?

Vendor vs joint vs separate handlers.

Contract
04

Is HQ extra-territorial?

Overseas decision-makers can be handlers.

Reach

Working rule: Map the regulated role before marketing or launch in China.

What changes the answer

The signal ledger.

These facts move the question beyond a label and into a product, money-flow and control analysis.

Signal
Ask the operating question
Why it changes the route
Processor label
Did the DPA call everyone a processor?
PIPL looks at who decides, not the English noun.
WFOE-only
Is the China entity a letterbox while HQ runs CRM?
HQ may be a handler.
SaaS as handler
Did the vendor set secondary purposes?
Then it may be a handler for those purposes.
Prepare before you escalate

Bring a compact evidence docket—not a pitch deck.

Give a compliance team or counsel the operating facts that reveal the perimeter.

01Decision mapWho wrote the privacy notice and retention rules.
02Vendor listHosting, CRM, payroll, analytics.
03Group policiesWhether HQ mandates purposes.
Common confusions

Questions people ask before they build.

Short answers for orientation. The right result can change with the service model and current rules.

Is a cloud vendor always entrusted?

If it only hosts to instruction, usually yes. If it mines data for its own models, handler risk.

Do we need a PRC representative?

Overseas handlers in scope may. That is a fact-specific PIPL Art. 53-style question.

Primary authorities

Reviewed sources support orientation, not a fact-specific assessment.

PIPL (NPC / official text)
Cyberspace Administration of China
National laws database (NPC)
gov.cn policy releases