Chapter V Obligations of Personal Information Processors
Article 56
Translation Notice
This is an unofficial English translation prepared for general informational purposes only. It does not constitute legal advice. In case of any discrepancy, the official Chinese text published by the competent authority shall prevail.
本文为非官方英文翻译，仅供一般信息参考，不构成法律意见。如与主管机关发布的中文正式文本不一致，以中文正式文本为准。
Chinese Original
第五十六条 个人信息保护影响评估应当包括下列内容： （一）个人信息的处理目的、处理方式等是否合法、正当、必要； （二）对个人权益的影响及安全风险； （三）所采取的保护措施是否合法、有效并与风险程度相适应。 个人信息保护影响评估报告和处理情况记录应当至少保存三年。
English Translation
A personal information protection impact assessment shall include the following contents: (1) whether the purpose and method of processing personal information are lawful, legitimate, and necessary; (2) the impact on personal rights and interests and the security risks; and (3) whether the protection measures taken are lawful, effective, and appropriate to the level of risk. Personal information protection impact assessment reports and processing records shall be retained for at least three years.
Plain English Note
Site explanation only. Not part of the translation.
Article 56 is part of Chapter V Obligations of Personal Information Processors. It should be read together with the official Chinese text, the source reference, and the related PIPL provisions.