Direct answer

Sensitive PI is a statutory subset — not ‘anything embarrassing’.

Under PIPL, sensitive personal information is PI that, once leaked or used unlawfully, can easily infringe dignity or endanger personal or property safety. The law lists biometrics, religious beliefs, specific identity, medical health, financial accounts, location tracking, and PI of minors under 14, plus other types specified by law. Processing SPI generally needs a specific purpose, sufficiency of necessity, strict protection, and separate consent unless another PIPL basis applies. A PIA is the usual companion. Do not call every HR file SPI; do not ignore geolocation SDKs.

The classification screen

4 questions before you choose the route.

This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.

01

Is it on the SPI list or equivalent?

Biometrics, health, accounts, tracking, under-14.

List
02

Is it necessary?

PIPL requires necessity, not convenience.

Necessity
03

Separate consent or another basis?

Open the separate-consent sibling.

Consent
04

Has a PIA been done?

SPI processing is a classic PIA trigger.

PIA

Working rule: Map the regulated role before marketing or launch in China.

What changes the answer

The signal ledger.

These facts move the question beyond a label and into a product, money-flow and control analysis.

Signal
Ask the operating question
Why it changes the route
Everything is SPI
Did you mark names and emails as SPI?
Ordinary PI still needs a lawful basis, but not SPI rules.
SDK location
Is a map SDK collecting precise location ‘just analytics’?
Location tracking is SPI.
Under-14 as adult
Did you age-gate with a checkbox only?
Children’s PI is a sibling plus SPI.
Prepare before you escalate

Bring a compact evidence docket—not a pitch deck.

Give a compliance team or counsel the operating facts that reveal the perimeter.

01Data typesWhich fields are biometrics, health, accounts, tracking, age.
02Purpose statementWhy each SPI field is necessary.
03Consent / PIA packSeparate consent language and PIA report.
Common confusions

Questions people ask before they build.

Short answers for orientation. The right result can change with the service model and current rules.

Is a national ID number SPI?

Specific identity can be SPI in context; do not assume a passport scan is ‘ordinary PI’.

Is employee bank account SPI?

Financial accounts are listed. Payroll still happens — with SPI controls, not a free pass.

Primary authorities

Reviewed sources support orientation, not a fact-specific assessment.

PIPL (NPC / official text)
Cyberspace Administration of China
National laws database (NPC)
gov.cn policy releases