Chapter II Rules for Processing Personal Information
Article 21
Translation Notice
This is an unofficial English translation prepared for general informational purposes only. It does not constitute legal advice. In case of any discrepancy, the official Chinese text published by the competent authority shall prevail.
本文为非官方英文翻译，仅供一般信息参考，不构成法律意见。如与主管机关发布的中文正式文本不一致，以中文正式文本为准。
Chinese Original
第二十一条 个人信息处理者委托处理个人信息的，应当与受托人约定委托处理的目的、期限、处理方式、个人信息的种类、保护措施以及双方的权利和义务等，并对受托人的个人信息处理活动进行监督。 受托人应当按照约定处理个人信息，不得超出约定的处理目的、处理方式等处理个人信息；委托合同不生效、无效、被撤销或者终止的，受托人应当将个人信息返还个人信息处理者或者予以删除，不得保留。 未经个人信息处理者同意，受托人不得转委托他人处理个人信息。
English Translation
Where a personal information processor entrusts the processing of personal information, it shall agree with the entrusted party on matters such as the purpose and period of the entrusted processing, the processing method, the categories of personal information, protection measures, and the rights and obligations of both parties, and shall supervise the personal information processing activities of the entrusted party. The entrusted party shall process personal information as agreed and shall not process personal information beyond the agreed processing purpose or processing method. If the entrustment contract does not take effect, is invalid, is revoked, or is terminated, the entrusted party shall return the personal information to the personal information processor or delete it, and shall not retain it. Without the consent of the personal information processor, the entrusted party shall not sub-entrust another person to process personal information.
Plain English Note
Site explanation only. Not part of the translation.
Article 21 governs entrusted processing. The personal information processor remains responsible for supervising the entrusted party.