标准编号:	GB/T 39335-2020
中文名称:	信息安全技术 个人信息安全影响评估指南
英文名称:	Information security technology—Guidance for personal information security impact assessment
中标分类:	L80    数据加密
行业分类:	GB    国家标准
ICS分类:	35.040 35.040    字符集和信息编码 35.040
发布机构:	国家市场监督管理总局 国家标准化管理委员会
发布日期:	2020-11-19
实施日期:	2021-6-1
标准状态:	valid
翻译语言:	英文
文件格式:	PDF
中文字符数:	25000 字
翻译价格(元):	1500.0
交付时间:	付款后 1 个工作日

Information security technology — Guidance for personal information security impact assessment 1 Scope This standard gives the basic principle and implementation process of personal information security impact assessment. This standard is applicable to the self-assessment of personal information security impact of various organizations and may also be used by competent regulatory authorities, the third-party testing and assessment agencies, etc. as a reference to the supervision, inspection and assessment of personal information security. 2 Normative references The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies. GB/T 20984 Information security technology — Risk assessment specification for information security GB/T 25069-2010 Information security technology — Glossary GB/T 35273-2020 Information security technology — Personal information security specification 3 Terms and definitions For the purposes of this document, the terms and definitions given in GB/T 25069-2010, GB/T 35273-2020 and the following apply. 3.1 personal information various information recorded electronically or otherwise that can, either alone or in combination with other information, identify a particular natural person or reflect the activity of such a person [GB/T 35273-2020, 3.1] 3.2 personal sensitive information personal information which, once disclosed, illegally provided or abused, will possibly endanger the personal and property safety and easily result in damages to personal reputation and physical and mental health or result in discriminatory treatment [GB/T 35273-2020, 3.2] 3.3 personal information subject natural person identified by or connected to personal information [GB/T 35273-2020, 3.3] 3.4 personal information security impact assessment process of inspecting the extent to which the personal information processing activities are lawful and compliant, of determining the various risks of such activities that cause damage to legitimate rights and interests of personal information subject and of assessing the effectiveness of various measures used to protect personal information subject 4 Assessment principle 4.1 General The purpose of personal information security impact assessment is to discover, dispose of and continuously monitor the risks that adversely affect the legitimate rights and interests of the personal information subject during the personal information processing. 4.2 Assessment value The implementation of personal information security impact assessment can effectively strengthen the protection of the rights and interests of the personal information subject, help an organization to show its efforts to protect personal information security, enhance transparency and enhance the trust of the personal information subject. The assessment value includes the following aspects: a) Before personal information processing, the organization may identify the risks that may damage the rights and interests of the personal information subject through impact assessment, and adopt appropriate personal information security control measures accordingly. b) During personal information processing, the organization may continuously revise the personal information security control measures already taken by considering the changes of internal and external factors through impact assessment, so as to ensure that the risk of adverse impact on the legitimate rights and interests of individuals is generally controllable. c) Personal information security impact assessment and its record documents may help the organization to prove its compliance with the laws, regulations and standards on personal information protection and data security in the investigation, law enforcement and compliance audit of the government, relevant institutions or business partners. d) In case of personal information security incident, the personal information security impact assessment and its record documents may be used to prove that the organization has actively assessed risks and taken certain security protection measures, which is helpful to reduce or even avoid the related responsibilities and reputation losses of the organization. e) The organization may strengthen the personal information security education for employees through personal information security impact assessment. During the assessment, employees may become familiar with various personal information security risks and improve their capacity of risk disposal. f) For partners, the organization shows that it takes personal information security protection seriously by practical assessment, and guides them to take appropriate security control measures to achieve the same or similar level of security protection. 4.3 Purposes of assessment report The contents of personal information security impact assessment report mainly include: the business scenarios covered by the assessment, the specific personal information processing activities involved in the business scenarios, the responsible departments and personnel and involved, the identified risks, the list of adopted and proposed security control measures, and the remaining risks, etc. Therefore, the purposes of the personal information security impact assessment report include but are not limited to: a) For the personal information subject, the assessment report may ensure that the subject knows how to dispose and protect his or her personal information, and enable him or her to judge whether there is any residual risk that has not been disposed of. b) For the organization conducting impact assessment, the purposes of the assessment report may include: 1) In the planning stage of products, services or projects, assessment report is used to ensure that the protection requirements of personal information are fully considered and realized in the design of products or services (e.g., the realizability, feasibility and traceability of security mechanism); 2) During the operation of products, services or projects, it is used to judge whether the internal and external factors of the operation (e.g., the change of the operation team, the Internet security environment, the third-party security control ability of information sharing), laws and regulations have undergone substantial changes, and whether the impact assessment results need to be reviewed and revised; 3) It is used to establish a responsibility system to supervise whether security protection measures have been taken for the personal information processing activities in security risks to improve or eliminate the identified risks; 4) It is used to enhance the personal information security awareness of internal employees. c) For the competent regulatory authorities, requiring an organization to provide the personal information security impact assessment report may urge the organization to carry out the assessment and take effective security control measures. When dealing with personal information security-related complaints and investigating personal information security incidents, the competent regulatory authorities may know about the relevant situation through the impact assessment report, or use the report as relevant evidence. d) For the partners of the organization carrying out the impact assessment, assessment report is used to understand their roles and functions in the business scenarios as a whole, as well as their specific personal information protection work and responsibilities. 4.4 Responsible subject of assessment The organization designates the department or personnel responsible for the establishment, implementation and improvement of the work process of personal information security impact assessment and for the quality of the work results of personal information security impact assessment. The responsible department or personnel is independent and not affected by the assessed party. Usually, the department leading the implementation of personal information security impact assessment in an organization is the legal service department, compliance department or information security department. The responsible department in the organization may choose to carry out the personal information security impact assessment by itself or hire an external independent third party to undertake the specific personal information security impact assessment according to the specific capacity of the department. For a specific product, service or project, the person in charge of the corresponding product, service or project shall ensure the development and smooth progress of the personal information security impact assessment activities, and give corresponding support. When the organization conducts its own personal information security impact assessment, the competent regulatory authorities and customers may require independent audits to verify the rationality and completeness of the impact assessment activities. At the same time, the organization allows the competent regulatory authorities to obtain evidence of the impact assessment process and related information systems or procedures. 4.5 Basic assessment principle The basic principle of personal information security impact assessment is shown in Figure 1. Figure 1 Schematic diagram for assessment principle Before assessment, it is necessary to conduct a comprehensive investigation on the object to be assessed (which may be a certain product, a certain business, a specific cooperation, etc.), form clear data lists and data flow charts, and sort out the specific personal information processing activities to be assessed. When carrying out the assessment, through analyzing the possible impact of personal information processing activities on the rights and interests of personal information subjects and its degree, as well as analyzing the effectiveness, the security incident risks and the possibility of security measures, obtain the security risks and risk level of personal information processing activities by combining the two results, and put forward corresponding improvement suggestions to form an assessment report. 4.6 Factors to be considered in assessment implementation 4.6.1 Assessment scale The scale of personal information security impact assessment often depends on the scope and number of impacted personal information subjects and the impact degree. Usually, when an organization carries out this kind of personal information security impact assessment, the type, sensitivity and number of personal information, the scope and number of subjects involved in personal information, and the scope of people who can access personal information will all become important factors of assessment scale. 4.6.2 Assessment methods The basic assessment methods used in the evaluation implementation process include but are not limited to the following three ones: a) Interview: the process in which an assessor talks with relevant personnel to know about, analyze and obtain evidence about the processing of personal information, and the design and implementation of protection measures in the information system. Interviewees include product managers, R&D engineers, persons in charge of personal information protection, persons in charge of legal affairs, system architects, security administrators, operation and maintenance personnel, human resources personnel and system users. b) Inspection: the process in which an assessor observes, inspects and analyzes the management system, security policies and mechanisms, contract and agreements, security configuration and design documents, operation records, etc. in order to know about, analyze or obtain evidence. The inspection objects are specifications, mechanisms and activities, such as personal information protection policy planning and procedures, system design documents and interface specifications, emergency planning drill results, event response activities, technical manuals and user/administrator guidances, and operation of information technology mechanisms in information system hardware/software, etc. c) Testing: the process in which an assessor conducts technical testing through manual or automated security testing tools, obtain relevant information, and conduct analysis to obtain evidence. The testing objects are security control mechanisms, such as access control, identity recognition and verification, security audit mechanism, transmission link and preservation encryption mechanism, continuous monitoring of important events, testing event response capability and emergency planning drill capability, etc. 4.6.3 Assessment forms From the implementation subject, personal information security impact assessment is classified into self-assessment and inspection assessment. Self-assessment refers to the organization's self-initiated assessment of its personal information processing behavior. Self-assessment may be carried out by the post or role designated by the organization to be responsible for assessment and audit, or an external professional organization may be entrusted to carry out assessment. Inspection assessment refers to the personal information security impact assessment initiated by the organization's superior organization, which directly leads the organization or is responsible for supervising and managing the organization. An external professional organization may also be entrusted to carry out inspection assessment. After determining the scale of assessment and selecting assessment methods and forms, the specific process of assessment implementation may refer to Clause 5. 5 Implementation process of assessment 5.1 Necessity analysis of assessment 5.1.1 General Personal information security impact assessment may be used for compliance gap analysis, as well as further improving one's own security risk management ability and security level. Therefore, the necessity of personal information security impact assessment depends on the organization's personal information security goal, and the organization may select the business scenarios to be initiated according to the actual needs. 5.1.2 Compliance gap assessment 5.1.2.1 General When the personal information security goal defined by the organization is to meet the baseline requirements of relevant laws, regulations or standards, the main purpose of personal information security impact assessment is to identify the gap between the security control measures taken for the specific personal information processing activities to be assessed and the specific requirements of relevant laws, regulations or standards, such as whether to share personal information with a third party in a business scenario and obtain the express consent of the personal information subject. 5.1.2.2 Overall compliance analysis According to applicable laws, regulations, policies and standards related to personal information protection, the organization may analyze the gap between all personal information processing activities related to specific products or services and applicable laws, regulations, policies and standards. The application scenarios of this assessment method include but are not limited to the following situations: a) annual overall assessment of products or services; b) design stage assessment of new products or services (whose technology platform is not limited); c) initial release assessment of new products or services (whose technology platform is not limited); d) re-assessment when there are major changes in laws, regulations, policies and standards, etc.; e) re-assessment when there are major changes in business model, Internet security environment and external environment, etc.; f) re-assessment after a major personal information security incident; g) assessment in case of acquisition, merger, reorganization, etc. 5.1.2.3 Partial compliance analysis According to applicable laws, regulations, policies and standards related to personal information protection, the organization may analyze the gap between partial personal information processing activities related to specific products or services and applicable laws, regulations, policies and standards. The application scenarios of this assessment method include but are not limited to the following situations: a) assessment when new personal information types are needed to be collected for new functions; b) assessment when there are partial changes in laws, regulations, policies and standards, etc.; c) assessment when there are changes in the business model, information system and operating environment. 5.1.2.4 Analysis of assessment compliance requirements Some laws, regulations and standards related to the personal information protection put forward the assessment compliance requirements. Such requirements do not put forward clear and specific security control measures for specific personal information processing activities, but require organizations to carry out risk assessment for specific personal information processing activities, and take security control measures commensurate with the degree of risk, so as to reduce the risk of adverse impact on the legitimate rights and interests of personal information subjects to an acceptable level, in order to meet the requirements. Assessment compliance requirements are often aimed at personal information processing activities that have a significant impact on personal rights and interests, such as processing sensitive personal information, processing personal information with automated decision-making methods, entrusting personal information processing, transferring or sharing personal information to third parties, publicly disclosing personal information, and transferring personal information abroad. In view of such requirements, the organization may use the personal information security impact assessment method provided in this guidance to ensure that the security risks of personal information processing activities are controllable to meet the requirements of corresponding laws, regulations and standards. Note: Please refer to Annex A for analysis examples of assessment compliance requirements and specific assessment points. 5.1.3 Due diligence risk assessment For the purposes of prudent operation, reputation maintenance, branding, etc., organizations often select personal information processing activities that may have high risks in the legitimate rights and interests of individuals, and carry out due diligence risk assessment for them. The goal of this risk assessment is to minimize the adverse impact on the legitimate rights and interests of the personal information subjects on the basis of meeting the baseline requirements of relevant laws, regulations and standards. Note: Please refer to Annex B for examples of high-risk personal information processing activities. The organization may use the personal information security impact assessment methods provided in this standard to assess high-risk personal information processing activities, and further reduce the security risks of personal information processing activities. 5.2 Assessment preparation 5.2.1 Establishment of assessment team The organization confirms and appoints personnel (assessor) responsible for personal information security impact assessment. In addition, the organization shall designate personnel to sign the assessment report. The assessor clearly specifies the object to submit the personal information security impact assessment report, the time period for the assessment, and whether to publish the assessment report or its abstract. If necessary, the assessor needs to request team support, such as a team composed of representatives from technical department, relevant business department and legal service department. The internal personal information security impact assessment needs long-term support from the organization management. The management shall allocate necessary resources for the personal information security impact assessment team.   5.2.2 Development of assessment plan The plan shall clearly define the work needed to complete the personal information security impact assessment report, the division of assessment tasks and the assessment schedule. In the plan, considerations shall also be given to the suspension or cancellation of the scenario to be assessed. The following aspects shall be considered during the specific operation: a) personnel, skills, experience and capacity; b) the time required to perform various tasks; c) resources required for each procedure of assessment, such as automated assessment tools. Note: It is recommended to update and iterate the original plan when the scenario involved is complex and consumes a lot of resources. For routine assessment activities or situations involving less complex scenario to be assessed, the original plan may be used or the procedure may be simplified. If consultation with relevant parties is involved, the plan shall explain under what circumstances the relevant parties need to be consulted, who will be consulted and the specific consultation methods (e.g., through public opinion surveys, seminars, focus groups, public hearings, online experiences). 5.2.3 Determination of the assessment object and scope Describe the assessment object and scope from the following three aspects: a) description of basic system information, including but not limited to: 1) purpose and type of personal information processing; 2) description of information systems supporting current or future business processes; 3) departments or related personnel performing information system management duties, and their duties or performance levels; 4) description of personal information processing methods, processing scope, and roles have authority of personal information access; 5) If it is expected to entrust a third party to handle the personal information, or share or transfer it with a third party, explain the identity of the third party and the access of the third party to the information system. b) description of system design information, including but not limited to: 1) overview of functional (or logical) structure; 2) overview of physical structure; 3) list and structure of information system databases, tables and fields containing personal information; 4) chart of data flow divided by components and interfaces; 5) chart of data flow of personal information life cycle, such as collection, storage, use and sharing of personal information; 6) description of the time node for informing the personal information subject, and the time node for obtaining the consent of the personal information subject, and the work flow chart; 7) list of interfaces available to transmit personal information externally; 8) security measures during personal information processing. c) description of the processing flow and plan information, including but not limited to: 1) the concept of identity and user management of information system; 2) operation concept, including the way that information systems or some of their structures adopt field operation, external hosting, or cloud outsourcing; 3) support concept, including listing the scope of third parties who have authority of personal information access, their personal information access authority and assess location; 4) record concept, including the saving plan of logged-in information; 5) backup and recovery plan; 6) protection and management of metadata; 7) data saving and deletion plan and storage medium disposal. 5.2.4 Development of the relevant party consultation plan Relevant parties include but are not limited to: ——employees, such as personnel related to human resources, law, information security, finance, business operation functions, communication and internal audit (especially in the regulatory environment); ——personal information subjects and consumer representatives; ——subcontractors and business partners; ——system development personnel and operation and maintenance personnel; ——other personnel in the organization who have corresponding concerns about the assessment. In order to make assessment process transparent and achieve the goal of security risk reduction, the assessor shall confirm in detail the internal or external relevant parties involved in the assessment process. Relevant parties have a direct interest relationship with the personal information processing activities to be assessed, and relevant parties may be any organizations or individuals who have or may obtain access permission for personal information. The assessor needs to confirm the classification of relevant parties, and then specifically confirm the specific organizations or individuals in various relevant parties. If the relevant party is an individual, the individual should be as representative as possible. The scope and scale of personal information, as well as business importance, cost and benefit, etc., are very important for determining the appropriate relevant parties. If large-scale personal information processing activities are to be assessed, there may be more relevant parties. In this case, social organizations (such as consumer rights and interests protection organizations) may be recognized as relevant parties. On the contrary, some small assessments may not need to confirm a broad list of relevant parties. When making the consultation plan, it is necessary to clarify the impacts and consequences (if known) suffered by different relevant parties, as well as the security control measures taken to reduce the adverse effects and other related issues. The consultation scope and schedule are also included in the plan. The objectives of the consultation plan include but are not limited to: a) determination of the number and scope of relevant parties; b) specific ways for relevant parties to participate in identification and assessment of the impact on personal rights and interests and the security risks; Note: Although issues raised in feedback from relevant parties may be related to subjective risk awareness, rather than objective actual risks, these opinions are not negligible. Organizations may deal with these opinions in a wider range of management issues of relevant parties to provide assistance for communication activities. c) consulting the relevant parties on the assessment report to confirm whether the report fully reflects their concerns about relevant issues. During personal information security impact assessment, the organization may urge appropriate relevant parties (mainly including subcontractors and business partners) to carry out personal information security impact assessment. Appropriate relevant parties have the obligation to carry out personal information security impact assessment, or cooperate with the organization to carry out personal information security impact assessment, and the organization may quote the personal information security impact assessment report of relevant parties as the consultation result. 5.3 Data flow analysis After conducting a comprehensive investigation on the personal information processing process, the organization forms a clear data list and data flow chart. The data flow analysis stage needs to combined with the specific scenarios of personal information processing. The investigation contents include personal information types, processing purposes and specific implementation methods involved in personal information collection, storage, usage, transfer, sharing and deletion, as well as resources (such as internal information systems) and relevant parties (such as third parties like personal information processors, platform operators, external service providers, cloud service providers etc.) involved in personal information processing. During the investigation, considered off-line systems, system data consolidation, enterprise acquisition, mergers and acquisitions, and global expansion, where possible. When sorting out the results of data flow analysis, the personal information processing activities are classified according to the types, sensitivity, collection scenarios, processing methods and relevant parties of personal information, as well as describing the specific situations of each type of personal information processing activities, for later impact analysis and risk assessment by classification. Note: For data flow analysis, may refer to Table C.1 and Table C.2 in Annex C. 5.4 Risk source identification The purpose of risk source identification is to analyze the threats faced in personal information processing activities, and whether the activities are lacking of adequate security measures and leads to vulnerability and security incidents. There are many factors that determine the occurrence of personal information security incidents. For threat sources, there are internal threats and external threats, as well as data theft caused by malicious personnel, and data leakage caused by non-malicious personnel unconsciously. For vulnerability, there are data damage caused by physical environment, and data leakage, tampering and loss caused by technical factors, and abuse caused by improper management. The threat identification and vulnerability identification methods described in GB/T 20984 may be used in the analysis process of personal information security incidents. In order to further simplify the analysis process of the possibility of personal information security incidents, the factors related to the possibility of personal information security incidents are summarized into the following four aspects: a) network environment and technical measures. Factors in assessment shall include but be not limited to the following aspects: 1) Whether the network environment of the information system processing personal information is the internal network or the Internet, different network environments face different threat sources, and the information system connected with the Internet faces higher risks; 2) The interaction mode between the information system processing personal information and other systems, such as, whether to use the network interface for data interaction, whether to embed third-party codes and plug-ins that may collect personal information, etc. Generally, the more data interaction, the more comprehensive security measures to be taken to prevent risks such as information leakage and theft; 3) Whether strict measures such as identity authentication and access control are implemented during personal information processing; 4) Whether boundary protection equipment is deployed, strict boundary protection strategy is configured, and technical measures for data leakage prevention are implemented at the network boundary; 5) Whether to monitor and record the running status of the network, whether to mark and analyze the status of personal information internally or interacting with a third party, to find abnormal traffic and illegal use in time; 6) Whether technical measures are taken to prevent network intrusion such as virus and Trojan backdoor attacks, port scanning, and denial of service attacks; 7) Whether to use encrypted transmission, encrypted storage and other measures to provide extra protection to personal sensitive information; 8) Whether to audit the personal information processing activities at stages of personal information collection, storage, transmission, usage and sharing, and warn for abnormal operation; 9) Whether a complete network security incident warning, emergency response and reporting mechanism has been established; 10) Whether the information systems are subjected to regular security inspection, assessment, infiltration test, as well as timely patch update and security reinforcement; 11) Whether to strengthen the security management of data storage media, and whether to have the ability to back up and restore data; 12) Other necessary technical support measures for network security. Note 1: If an organization establishes a mature security protection system with reference to other national standards related to network security and data security, it may conduct analysis and assessment based on its existing foundation. b) personal information processing procedure. Factors in assessment shall include but be not limited to the following aspects: 1) Whether the judgment of personal sensitive information is accurate; 2) Whether the purpose of personal information collection is legitimate and legal; 3) Whether the data obtained from the third party is officially authorized for processing; 4) Whether the notification method and content are friendly and accessible, whether all processing activities have been approved by users; 5) Whether the minimum element set of personal information is defined, whether personal information is collected beyond the scope; 6) Whether changing the purpose of using personal information has an impact on the personal information subject; 7) Whether to provide a convenient and effective mechanism for individual participation, including inquiry, correction, deletion, withdrawal consent, account cancellation, etc.; 8) Whether the third party that receiving personal information will change the purpose of using on personal information; 9) Whether the retention time of personal information is minimized, whether the mechanism such as deleting beyond the time limit is reasonable; 10) Whether to restrict the user profiling mechanism to avoid accurate pointing to specific individuals; 11) Whether to provide a mechanism that may be control, exit or close by users for personalized display; 12) Whether the anonymization mechanism is effective, whether the de-identified personal information can be correlated and analyzed, etc., resulting in re-identification of the identity of the subject of personal information subject; 13) Whether to provide timely and effective security incident notification mechanism and emergency response mechanism; 14) Whether to provide effective complaints and rights protection channels; 15) Whether to share or transfer personal information to a third party without the consent of the user; 16) Whether inaccurate data or incomplete misleading data are disseminated; 17) Whether to induce or force individuals to provide too much personal information; 18) Whether to track or monitor personal behavior too much; 19) Whether to unreasonably restrict individuals from controlling their personal information, etc.; 20) Normalization of other personal information processing procedures. Note 2: The normative analysis of personal information processing flow may refer to the corresponding contents of GB/T 35273-2020. c) participants and third parties. Factors in assessment shall include but be not limited to the following aspects: 1) Whether to appoint responsible person and working agency for personal information protection; whether the responsible person for personal information protection is with relevant management experience and professional knowledge of personal information protection. 2) Whether to develop and implement personal information security management policies and strategies according to business security requirements; 3) Whether to develop security management system involving all aspects of personal information processing and put forward specific security management requirements; 4) Whether to sign confidentiality agreement with relevant personnel engaged in personal information processing and conduct background investigation on those who have access to large quantities of personal sensitive information; 5) Whether to specify security duties of different internal posts involving personal information processing, as well as establish a penalty and accountability system for security incidents; 6) Whether to launch professional training and assessment to personal information security for relevant personnel engaged in personal information processing so as to ensure that relevant personnel are proficient in the privacy policy and related procedures. 7) Whether to specify the personal information security requirements that external service personnel who may access personal information to comply with, and implement supervision; 8) Whether to sign binding contracts and other documents with a third party, and stipulate the processing purpose, method, data retention time and processing method if overdue, after the personal information is transmitted to the third party; 9) Whether the third party's handling of personal information is regularly inspected and audited to ensure that it strictly implements the contract and other agreements; 10) Other necessary measures. Note 3: If an organization establishes a mature security management system with reference to other national standards related to network security and data security, it may conduct analysis and assessment based on its existing foundation. d) business characteristics, scale and security situation. Factors in assessment shall include but be not limited to the following aspects: 1) Business dependence on personal information processing; 2) The number, frequency, user scale and peak value of personal information that the business processes or may process; 3) Whether there have been incidents such as leakage, tampering, damage or loss of personal information; 4) Law enforcement supervision trends related to personal information protection; 5) Suffering from cyber-attacks or security incidents in the near future; 6) Recently received or publicly released security-related warning information. After fully understanding the corresponding contents of the above dimensions, the organization identifies the measures taken and the current status by means of investigation and interview, consulting supporting documents, functional inspection and technical test. According to the different dimensions of the analysis of personal rights and interests in 5.5, the possibility level of security incidents is comprehensively assessed from the above four aspects. Note 4: Please refer to D.1 in Annex D for the assessment of security event possibility level. 5.5 Analysis of the impact of personal rights and interests 5.5.1 Dimension of personal rights and interests Personal rights and interests impact analysis refers to analyzing whether specific personal information processing activities will have an impact on the legitimate rights and interests of the personal information subject, and what kind of impact it may have. The impact of personal rights and interests may be summarized into four dimensions: "limiting individual autonomy", "causing differential treatment", "personal reputation damage or mental stress" and "personal property damage": a) Limiting the individual's autonomy, such as being forced to perform unwilling operations, lacking relevant knowledge or relevant channels to correct personal information, unable to choose to refuse the push of personalized advertisements, and being deliberately pushed with information that affects the judgment of personal values; b) Causing differential treatment, such as discrimination against individual rights caused by information leakage such as illness, marriage history and student status, and damage to individual fair trade rights caused by abuse of information such as personal consumption habits; c) Personal reputation damage or mental stress, such as being fraudulently used by others, revealing habits and experiences that are unwilling to be known, being frequently harassed, monitored and tracked, etc.; d) Personal property damage, such as personal injury, theft of capital account, fraud, extortion, etc.   5.5.2 Analysis process of personal rights and interests impact According to the results of data flow analysis and the personal information processing activities that need to be assessed, combined with the requirements of relevant laws, regulations and standards or the personal information security objectives defined by the organization, the organization may analyze the possible impact of the whole life cycle of personal information processing activities or specific processing behaviors on personal rights and interests, as well as the possible impact of personal information disclosure, damage, loss and abuse on personal rights and interests, so as to examine whether there is any risk of infringing the rights and interests of personal information subjects. The process of personal rights and interests impact analysis generally includes four stages: sensitivity analysis of personal information, characteristics analysis of personal information processing activities, problems analysis of personal information processing activities and impact analysis: a) In the analysis stage of personal information sensitivity, the organization may refer to the relevant national laws, regulations and standards and analyze the possible impact of personal information sensitivity on personal rights and interests according to the data flow analysis results. For example, the disclosure and abuse of health physiological information may have a serious impact on personal physiology and psychology; b) In the stage of analyzing the characteristics of personal information processing activities, the organization may refer to the relevant national laws, regulations and standards and analyze whether the personal information processing activities involve restricting personal autonomy, causing differential treatment, personal reputation damage or mental stress, personal property damage, etc. For example, public disclosure of personal experiences may have an impact on personal reputation; c) In the analysis stage of personal information processing activities, the organization may analyze the possible weaknesses, gaps and problems of personal information processing activities according to the data flow analysis results, with reference to the relevant national laws, regulations and standards. The normative analysis results of personal information process in 5.4b) may support the analysis process in this stage, and the analysis of the severity of the problems is helpful to analyze the impact degree of personal rights and interests; d) In the analysis stage of personal rights and interests impact degree, the organization may comprehensively analyze the possible impact of personal information processing activities on personal rights and interests and its severity by combining the analysis results of previous stages. Note: Refer to D.2 for the assessment of personal rights and interests. 5.6 Comprehensive analysis of security risks When conducting comprehensive analysis of security risks, the following steps may be taken with reference to the basic principles in 4.5: a) With reference to 5.4, analyze the implemented security measures, relevant parties, treatment scale and other factors, and assess the possibility level of security incidents; b) With reference to 5.5, analyze the impact of possible security incidents on personal rights and interests, and assess the degree of impact on personal rights and interests; c) considering the possibility of security incidents and the impact degree of personal rights and interests, the security risk level of personal information processing activities is obtained through comprehensive analysis. Note: Please refer to D.3 for the specific process of security risk analysis and the judgment of risk level, and refer to Table C.3, Table C.4 and Table C.5 for the specific process of security risk analysis. After completing the impact assessment of specific personal information processing activities, the organization may synthesize the assessment results of all relevant personal information processing activities to form the risk level of the whole assessment object (such as business department, specific project, specific cooperation, etc.).

Foreword i 1 Scope 2 Normative references 3 Terms and definitions 4 Assessment principle 4.1 General 4.2 Assessment value 4.3 Purposes of assessment report 4.4 Responsible subject of assessment 4.5 Basic assessment principle 4.6 Factors to be considered in assessment implementation 5 Implementation process of assessment 5.1 Necessity analysis of assessment 5.2 Assessment preparation 5.3 Data flow analysis 5.4 Risk source identification 5.5 Analysis of the impact of personal rights and interests 5.6 Comprehensive analysis of security risks 5.7 Assessment report 5.8 Risk disposal and continuous improvement 5.9 Report release strategy development Annex A (Informative) Examples of assessment compliance and key points of assessment Annex B (Informative) Examples of high-risk personal information processing activities Annex C (Informative) Common-used tool tables for personal information security impact assessment Annex D (Informative) Personal information security impact assessment reference method Bibliography

信息安全技术 个人信息安全影响评估指南 1 范围 本标准给出了个人信息安全影响评估的基本原理、实施流程。 本标准适用于各类组织自行开展个人信息安全影响评估工作，同时可为主管监管部门、第三方测评机构等组织开展个人信息安全监督、检查、评估等工作提供参考。 2 规范性引用文件 下列文件对于本文件的应用是必不可少的。凡是注日期的引用文件，仅注日期的版本适用于本文件。凡是不注日期的引用文件，其最新版本(包括所有的修改单)适用于本文件。 GB/T 20984 信息安全技术 信息安全风险评估规范 GB/T 25069—2010 信息安全技术 术语 GB/T 35273—2020 信息安全技术 个人信息安全规范 3 术语和定义 GB/T 25069—2010、GB/T 35273—2020 界定的以及下列术语和定义适用于本文件。 3.1 个人信息 personal information 以电子或者其他方式记录的能够单独或者与其他信息结合识别特定自然人身份或者反映特定自然人活动情况的各种信息。 [GB/T 35273—2020，定义3.1] 3.2 个人敏感信息 personal sensitive information 一旦泄露、非法提供或滥用可能危害人身和财产安全，极易导致个人名誉、身心健康受到损害或歧视性待遇等的个人信息。 [GB/T 35273—2020，定义3.2] 3.3 个人信息主体 personal information subject 个人信息所标识或者关联的自然人。 [GB/T 35273—2020，定义3.3] 3.4 个人信息安全影响评估 personal information security impact assessment 针对个人信息处理活动，检验其合法合规程度，判断其对个人信息主体合法权益造成损害的各种风险，以及评估用于保护个人信息主体的各项措施有效性的过程。 4 评估原理 4.1 概述 个人信息安全影响评估旨在发现、处置和持续监控个人信息处理过程中对个人信息主体合法权益造成不利影响的风险。 4.2 开展评估的价值 实施个人信息安全影响评估，能够有效加强对个人信息主体权益的保护，有利于组织对外展示其保护个人信息安全的努力，提升透明度，增进个人信息主体对其的信任。包括： a) 在开展个人信息处理前，组织可通过影响评估，识别可能导致个人信息主体权益遭受损害的风险，并据此采用适当的个人信息安全控制措施。 b) 对于正在开展的个人信息处理，组织可通过影响评估，综合考虑内外部因素的变化情况，持续修正已采取的个人信息安全控制措施，确保对个人合法权益不利影响的风险处于总体可控的状态。 c) 个人信息安全影响评估及其形成的记录文档，可帮助组织在政府、相关机构或商业伙伴的调查、执法、合规性审计等中，证明其遵守了个人信息保护与数据安全等方面的法律、法规和标准的要求。 d) 在发生个人信息安全事件时，个人信息安全影响评估及其形成的记录文档，可用于证明组织已经主动评估风险并采取一定的安全保护措施，有助于减轻、甚至免除组织相关责任和名誉损失。 e) 组织可通过个人信息安全影响评估，加强对员工的个人信息安全教育。参与评估之中，员工能熟悉各种个人信息安全风险，增强处置风险的能力。 f) 对合作伙伴，组织通过评估的实际行动表明其严肃对待个人信息安全保护，并引导其能够采取适当的安全控制措施，以达到同等或类似的安全保护水平。 4.3 评估报告的用途 个人信息安全影响评估报告的内容主要包括：评估所覆盖的业务场景、业务场景所涉及的具体的个人信息处理活动、负责及参与的部门和人员.已识别的风险.已采用及拟采用的安全控制措施清单、剩余风险等。 因此，个人信息安全影响评估报告的用途包括但不限于： a) 对于个人信息主体，评估报告可确保个人信息主体了解其个人信息被如何处理、如何保护，并使个，人信息主体能够判断是否有剩余风险尚未得到处置。 b) 对于开展影响评估的组织，评估报告的用途可能包括： 1) 在产品、服务或项目的规划阶段，用于确保在产品或服务的设计中充分考虑并实现个人信息的保护要求(例如，安全机制的可实现性、可行性、可追踪性等)； 2) 在产品、服务或项目的运营过程中，用于判断运营的内外部因素(例如运营团队的变动、互联网安全环境、信息共享的第三方安全控制能力等)、法律法规是否发生实质变更，是否需要对影响评估结果进行审核和修正； 3) 用于建立责任制度，监督发现存在安全风险的个人信息处理活动是否已采取安全保护措施，改善或消除已识别的风险； 4) 用于提升内部员工的个人信息安全意识。 c) 对于主管监管部门，要求组织提供个人信息安全影响评估报告，可督促组织开展评估并采取有效的安全控制措施。在处理个人信息安全相关投诉、调查个人信息安全事件等时，主管监管部门可通过影响评估报告了解相关情况，或将报告作为相关证据。 d) 对于开展影响评估的组织的合作伙伴，用于整体了解其在业务场景中的角色和作用，以及其应具体承担的个人信息保护工作和责任。 4.4 评估责任主体 组织指定个人信息安全影响评估的责任部门或责任人员，由其负责个人信息安全影响评估工作流程的制定、实施、改进，并对个人信息安全影响评估工作结果的质量负责。该责任部门或人员具有独立性，不受到被评估方的影响。通常，组织内部牵头执行个人信息安全影响评估工作的部门为法务部门、合规部门或信息安全部门。 组织内的责任部门可根据部门的具体能力配备情况，选择自行开展个人信息安全影响评估工作，或聘请外部独立第三方来承担具体的个人信息安全影响评估工作。 对于具体的产品、服务或项目，由相应的产品、服务或项目负责人确保个人信息安全影响评估活动的开展和顺利进行，并给予相应支持。 当由组织自行进行个人信息安全影响评估时，主管监管部门和客户可要求独立审计来核证影响评估活动的合理性和完备性。同时，该组织允许主管监管部门对影响评估流程以及相关信息系统或程序进行取证。 4.5 评估基本原理 个人信息安全影响评估的基本原理如图1。 数据映射分析 待评估的个人信息处理活动 个人权益影响分析 个人权益影响程度 安全保护措施有效性分析 安全事件可能性程度 风险级别 图1 评估原理示意图 开展评估前，需对待评估的对象(可为某项产品、某类业务、某项具体合作等)进行全面的调研，形成清晰的数据清单及数据映射图表(data flow charts)，并梳理出待评估的具体的个人信息处理活动。开展评估时，通过分析个人信息处理活动对个人信息主体的权益可能造成的影响及其程度，以及分析安全措施是否有效、是否会导致安全事件发生及其可能性，综合两方面结果得出个人信息处理活动的安全风险及风险等级，并提出相应的改进建议，形成评估报告。 4.6 评估实施需考虑的要素 4.6.1 评估规模 个人信息安全影响评估的规模往往取决于受到影响的个人信息主体范围、数量和受影响的程度。通常，组织在实施该类个人信息安全影响评估时，个人信息的类型、敏感程度、数量，涉及个人信息主体的范围和数量，以及能访问个人信息的人员范围等，都会成为影响评估规模的重要因素。 4.6.2 评估方法 评估实施过程中采用的基本评估方法，包括但不限于以下三种： a) 访谈：指评估人员对相关人员进行谈话，以对信息系统中个人信息的处理、保护措施设计和实施情况进行了解、分析和取证的过程。访谈的对象包括产品经理、研发工程师、个人信息保护负责人、法务负责人员、系统架构师、安全管理员、运维人员、人力资源人员和系统用户等。 b) 检查：指评估人员通过对管理制度、安全策略和机制、合同协议、安全配置和设计文档、运行记录等进行观察、查验、分析，以便理解、分析或取得证据的过程。检查的对象为规范、机制和活动，如个人信息保护策略规划和程序、系统的设计文档和接口规范、应急规划演练结果、事件响应活动、技术手册和用户/管理员指南、信息系统的硬件/软件中信息技术机制的运行等。 c) 测试：指评估人员通过人工或自动化安全测试工具进行技术测试，获得相关信息，并进行分析以便获取证据的过程。测试的对象为安全控制机制，如访问控制、身份识别和验证、安全审计机制、传输链路和保存加密机制.对重要事件进行持续监控、测试事件响应能力以及应急规划演练能力等。 4.6.3 评估工作形式 从实施主体来区分，个人信息安全影响评估分为自评估和检查评估两种形式。 自评估是指组织自行发起对其个人信息处理行为的评估，自评估可以由本组织指定专门负责评估、审计的岗位或角色开展，也可以委托外部专业组织开展评估工作。 检查评估是指组织的上级组织发起的个人信息安全影响评估工作。上级组织是对组织有直接领导关系或负有监督管理责任的组织。检查评估也可以委托外部专业组织开展评估。 在确定评估规模，选定评估方法、评估工作形式后，评估实施的具体流程可参照第5章内容。 5 评估实施流程 5.1 评估必要性分析 5.1.1 概述 个人信息安全影响评估可用于合规差距分析，也可以用于合规之上、进一步提升自身安全风险管理能力和安全水平的目的。因此启动个人信息安全影响评估的必要性，取决于组织的个人信息安全目标，组织可根据实际的需求选取需要启动评估的业务场景。 5.1.2 合规差距评估 5.1.2.1 概述 当组织定义的个人信息安全目标为符合相关法律、法规或标准的基线要求时，则个人信息安全影响评估主要目的在于识别待评估的具体个人信息处理活动已采取的安全控制措施，与相关法律、法规或标准的具体要求之间的差距，例如在某业务场景中与第三方共享个人信息，是否取得了个人信息主体的明示同意。 5.1.2.2 整体合规分析 组织可根据所适用的个人信息保护相关法律、法规、政策及标准，分析特定产品或服务所涉及的全部个人信息处理活动与所适用规则的差距。该评估方式的应用场景包括但不限于以下情形： a) 产品或服务的年度整体评估； b) 新产品或新服务(不限技术平台)设计阶段评估； c) 新产品或新服务(不限技术平台)上线初次评估； d) 法律法规、政策、标准等出现重大变化时重新评估； e) 业务模式、互联网安全环境、外部环境等发生重大变化的重新评估； f) 发生重大个人信息安全事件后重新评估； g) 发生收购、兼并、重组等情形开展评估。 5.1.2.3 局部合规分析 组织可根据所适用的个人信息保护相关法律、法规.政策及标准，对特定产品或服务所涉及的部分个人信息处理活动与所适用规则的差距进行分析。该评估方式的应用场景包括但不限于以下情形： a) 新增功能需要收集新的个人信息类型时的评估； b) 法律、法规、政策、标准出现部分变化时的评估； c) 业务模式、信息系统、运行环境等发生变化时评估。 5.1.2.4 评估性合规要求分析 部分个人信息保护相关的法律、法规、标准的规定提出了评估性合规要求。这类规定并没有针对特定的个人信息处理活动提出明确、具体的安全控制措施，而是要求组织针对特定个人信息处理活动，专门开展风险评估，并采取与风险程度相适应的安全控制措施，将对个人信息主体合法权益不利影响的风险降低到可接受的程度，才符合其规定。 评估性合规要求往往针对的是对个人权益有重大影响的个人信息处理活动，例如处理个人敏感信息、使用自动化决策方式处理个人信息、委托处理个人信息、向第三方转让或共享个人信息、公开披露个人信息、向境外转移个人信息等。 针对此类规定，组织可使用本指南提供的个人信息安全影响评估方法进行评估，保证个人信息处理活动的安全风险可控，以符合相应的法律、法规、标准的要求。 注：评估性合规要求分析示例及具体评估要点可参考附录A。 5.1.3 尽责性风险评估 出于审慎经营、声誉维护、品牌建立等目的，组织往往选取可能对个人合法权益产生高风险的个人信息处理活动，开展尽责性风险评估。此种风险评估的目标，是在符合相关法律、法规和标准的基线要求之上，尽可能降低对个人信息主体合法权益的不利影响。 注：高风险个人信息处理活动示例可参考附录B。 组织可使用本标准提供的个人信息安全影响评估方法，对高风险个人信息处理活动进行评估，进一步降低个人信息处理活动的安全风险。 5.2 评估准备工作 5.2.1 组建评估团队 组织确认并任命负责进行个人信息安全影响评估的人员(评估人)。此外，组织还要指定人员负责签署评估报告。 评估人明确规定个人信息安全影响评估报告的提交对象、个人信息安全影响评估的时间段、是否会公布评估报告或其摘要。 如有必要评估人需申请团队支持，例如由技术部门、相关业务部门及法律部门的代表构成的团队。组织内部个人信息安全影响评估需要组织管理层给予长期支持。 管理层需为个人信息安全影响评估团队配置必要资源。 5.2.2 制定评估计划 计划需清楚规定完成个人信息安全影响评估报告所进行的工作、评估任务分工、评估计划表。此外，计划还需考虑到待评估场景中止或撤销的情况。具体操作时考虑以下方面： a) 人员、技能、经验及能力； b) 执行各项任务所需时间； c) 进行评估每一步骤所需资源，如自动化的评估工具等。 注：涉及的场景复杂、耗用资源多时，建议对原有方案进行更新迭代，针对常规评估活动或涉及待评估场景复杂度低等情形时，可沿用原有计划或简化该步骤。 如涉及相关方咨询，计划需说明在何种情况下需要咨询相关方、将咨询哪些人员以及具体的咨询方式(例如通过公众意见调查、研讨会、焦点小组、公众听证会、线上体验等等)。 5.2.3 确定评估对象和范围 从以下三个方面描述评估的对象和范围： a) 描述系统基本信息，包括但不限于： 1) 处理个人信息的目的和类型； 2) 对支撑当前或未来业务流程的信息系统的描述； 3) 履行信息系统管理职责的部门或相关人员，以及其职责或履行水平； 4) 关于个人信息处理方式、处理范围的说明、有权访问个人信息的角色等； 5) 如预计委托第三方处理，或与第三方共享、转让信息系统的个人信息，说明上述第三方身份、第三方接入信息系统的情况等。 b) 描述系统设计信息，包括但不限于： 1) 功能(或逻辑)结构概览； 2) 物理结构概览； 3) 包含个人信息的信息系统数据库、表格和字段的清单和结构； 4) 按组件和接口划分的数据流示意图； 5) 个人信息生命周期的数据流示意图，例如个人信息的收集、存储、使用和共享等； 6) 描述通知个人信息主体的时间节点以及取得个人信息主体同意的时间节点和工作流程图； 7) 可对外传输个人信息的接口清单； 8) 个人信息处理过程中的安全措施。 c) 描述处理流程和程序信息，包括但不限于： 1) 信息系统的身份与用户管理概念； 2) 操作概念，包括信息系统或其中部分结构采用现场运行、外部托管，或云外包的方式； 3) 支持概念，包括列示可访问个人信息的第三方范围、其所拥有的个人信息访问权限、其可访问个人信息的位置等； 4) 记录概念，包括已登入信息的保存计划； 5) 备份与恢复计划； 6) 元数据的保护与管理； 7) 数据保存与删除计划及存储介质的处置。 5.2.4 制定相关方咨询计划 相关方包括但不限于： ——员工，例如人力资源、法律、信息安全、财务、业务运营职能、通信与内部审计(尤其是在监管环境下)相关人员； ——个人信息主体和消费者代表； ——分包商和业务合作伙伴； ——系统开发和运维人员； ——对于评估有相应担忧的其他组织人员。 为保证评估流程的透明，实现降低安全风险的目标，评估人需详细确认进人评估程序的内部或外部相关方。相关方与待评估的个人信息处理活动具有直接的利益关系，相关方可以是拥有或可能获取个人信息访问权限的组织或个人。 评估人需确认相关方的分类，然后具体确认各类相关方中的特定组织或个人。如果相关方为个人，则该个人宜尽可能具有代表性。 个人信息的范围与规模，以及业务重要性、成本收益等因素，对于确定恰当的相关方非常重要。如对大型个人信息处理活动进行评估，则可能存在较多相关方。在这种情况下，社会团体(如消费者权益保护组织)可能被确认为相关方。相反，一些小型评估，可能不需要确认宽泛的相关方清单。 制定咨询计划需明确不同的相关方所受的影响、后果(如果已知)以及所采取的用于降低不利影响的安全控制措施等相关问题。计划中还包含咨询范围及计划表。 咨询计划的目标包括但不限于： a) 确定相关方的数量与范围； b) 相关方参与识别并评估个人权益影响及安全风险的具体方式； 注：相关方的反馈意见所提出的问题可能与主观风险认识有关，而非客观实际风险，但不能忽略这些意见，组织可将这些意见放在更广泛的相关方管理问题中进行处理，为交流活动提供帮助。 c) 就评估报告咨询相关方意见，以确认报告是否充分反映他们对有关问题的关注。 组织在开展个人信息安全影响评估时，可以督促适当的相关方(主要包括分包商和业务合作伙伴)开展个人信息安全影响评估。适当的相关方有义务开展个人信息安全影响评估，或者配合组织开展个人信息安全影响评估，组织可以引用相关方的个人信息安全影响评估报告作为咨询结果。 5.3 数据映射分析 组织在针对个人信息处理过程进行全面的调研后，形成清晰的数据清单及数据映射图表。 数据映射分析阶段需结合个人信息处理的具体场景。调研内容包括个人信息收集、存储、使用、转让、共享、删除等环节涉及的个人信息类型、处理目的、具体实现方式等，以及个人信息处理过程涉及的资源(如内部信息系统)和相关方(如个人信息处理者、平台经营者、外部服务供应商、云服务商等第三方)。调研过程中尽可能考虑已下线系统、系统数据合并、企业收购、并购及全球化扩张等情况。 梳理数据映射分析的结果时，根据个人信息的类型、敏感程度、收集场景、处理方式、涉及相关方等要素，对个人信息处理活动进行分类，并描述每类个人信息处理活动的具体情形，便于后续分类进行影响分析和风险评价。 注：开展数据映射分析，可参考附录C中表C.1和表C.2。