T/SIA 001-2022 Active

Scope: This standard is designed to implement the "Personal Information Protection Law of the People's Republic of China", aiming to guide software and information technology service enterprises to safely and reasonably utilize personal information, standardize their personal information processing activities, and enhance their personal information security management level. This standard applies to software and information technology service enterprises. Application software and information technology service institutions, schools, medical institutions, social groups, etc. may refer to and implement it. Organizations, institutions, and units are collectively referred to as enterprises in this standard. The objects of personal information management covered by this standard include enterprise internal employees, applicants, customers, third-party service providers, and personnel from business outsourcing agencies. This standard can serve as the evaluation and certification basis for third-party assessment agencies and certification bodies. Main technical content: This standard sets out the basic requirements for personal information security management in enterprises, including leadership role, planning, support, processing procedures, security management, monitoring, improvement, exceptions, and certification. 1. Scope 2. Normative reference documents 3. Terms and definitions 4. Basic requirements 4.1 Principles 4.2 Rights of personal information subjects 4.3 Corporate responsibilities 5. Leadership role 5.1 Top management and responsibilities 5.2 Management policies 5.3 Organizational structure 6. Planning 6.1 Management plans 6.2 Risk management 7. Support 7.1 Personnel management 7.2 Publicity and training 7.3 Management regulations 7.4 Document control 8. Processing procedures 8.1 Collection 8.2 Storage 8.3 Use 8.4 Transfer 8.5 Post-processing 8.6 Opinion processing 8.7 Emergency management 9. Security management 9.1 Physical environment management 9.2 Wor