PIPL (Personal Information Protection Law)
China's national data protection law, effective November 2021, whose Article 28 defines sensitive personal information as data that, if leaked or misused, could easily harm a natural person's dignity, safety, or property, explicitly naming biometric information, religious belief, medical health, and location tracking among others; Article 29 requires separate consent for its processing.
Defined in 2 GAGE programs, which carry 5 distinct definitions of it. The wording above is taught in Certified AI Data Governance Professional (CADGP).
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
China's national data protection law, effective November 2021, whose Article 28 defines sensitive personal information as data that, if leaked or misused, could easily harm a natural person's dignity, safety, or property, explicitly naming biometric information, religious belief, medical health, and location tracking among others; Article 29 requires separate consent for its processing.
China's comprehensive personal-information-protection statute (2021, unamended as of Jul 2026), applying to any AI deployment that processes personal information, including extraterritorially under Article 3 where Chinese individuals are targeted.
China's comprehensive data protection law, in force since 2021, using a permission-first structure with consent as the default expectation and a shorter list of named alternative grounds, layered with a separately stricter cross-border transfer assessment obligation.
China's comprehensive personal data protection statute, in force since November 2021 and unamended as of July 2026, whose extraterritorial scope (Article 3) is a primary source of Channel 2 reach for organizations with no China presence.
China's 2021 data-protection statute; its Article 3 extraterritorial-reach provision is the primary basis for Section 3E and Section 3M's step-zero jurisdictional question for foreign-facing deployments. (see Topic 1.2)
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- Lawful basis, spelled out: consent, contract, legitimate interest, and which one actually covers each dataset · Consent, Purpose, and the Law of Data, Certified AI Data Governance Professional (CADGP)
- Special categories and the fields you did not know were sensitive · Consent, Purpose, and the Law of Data, Certified AI Data Governance Professional (CADGP)
- Why China's AI Rules Reach You · Onboarding: China Regulates AI First, Certified China AI Regulatory Professional (CCARP)
- Regulatory Mapping Exercise · China's AI Regulatory Architecture, Certified China AI Regulatory Professional (CCARP)
- Lab: GenAI Compliance Audit · Generative AI Compliance, Certified China AI Regulatory Professional (CCARP)
Where it shows up at work
A definition is where PIPL (Personal Information Protection Law) starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Scopes an AI audit, sets criteria, samples, interviews, tests, writes findings with condition, criteria, cause, effect and recommendation, and tracks remediation.
One lesson on this page teach it as a primary outcome.
Collects, labels and preserves the evidence that a control operated, a decision was made, and a claim can be defended to an auditor or regulator.
One lesson on this page teach it as a primary outcome.
Finds every AI system in use, records owner, purpose, data and risk tier, and keeps the record alive as tools change.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- Chief Audit Executive, AI audit editionneeds it at depth
- AI Auditorneeds it at depth · 9 open postings this week
- AI Governance Analystneeds working knowledge · 3 open postings this week
- AI Governance Coordinatorneeds it at depth
- Governance Analystneeds working knowledge · 6 open postings this week
- AI Compliance Specialistneeds working knowledge · 1 open posting this week
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: Global Internal Audit Standards; ISO/IEC 42001 Clause 9.2; ISO 19011; EU AI Act Articles 11 and 12.
One interview question about it
How does an AI audit differ from an AI risk assessment, and what would make you refuse to sign an assurance opinion?
Asked of candidates for ai audit and independent assurance. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Internal audit and IT audit carries it as work you can show: Audit programs, workpapers and findings are your record.
- Compliance and regulatory affairs carries it as work you can show: Audit-ready documentation is what you produce.
- Project and program management carries it as a claim to back up: Decision logs and repositories are familiar.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.