个保法下的 PDF 工具要求：八个能当场核对的点 / China PIPL PDF Tools: Eight Requirements to Check

一句话结论 / Short answer

判断一套 PDF 处理流程是否符合《个人信息保护法》，不需要通读全文，只要把八个问题答完，而且每份答案都要能落到纸面上：文件里有没有个人信息、有没有敏感个人信息、处理目的和方式是否写明、该拿同意的场景有没有拿到单独同意、有没有委托处理协议、受托方能不能再转委托、个人信息有没有出境、以及保存多久与怎么证明删除。八项都有书面答案，这套流程可以通过内部评审；少一项，评审意见里就得写一句证据不足。

Judging a PDF workflow against the Personal Information Protection Law does not mean reading the whole text. It means eight answers on paper: does the file hold personal information, is any of it sensitive, are purpose and method stated, was separate consent obtained where the law requires it, is there an entrustment agreement, can the processor pass the work on, does anything cross the border, how long is it kept and how is deletion proven. Eight written answers clear an internal review. One gap and the note says the evidence falls short.

最省力的一步是把第七项直接变成不存在。文件在浏览器里从头处理到尾、不产生上传，就不存在向境外提供个人信息的环节，安全评估、标准合同、保护认证三条路径一条都不用走，第五、六项的论证也一并消失。剩下的工作从论证降级为记录，这也是为什么很多合规岗现在先问"能不能在本机跑完"，再问别的。第七项为空的情况下，/blog/merge-pdf-no-upload 这类本地流程天然少一整章要写的材料。

The cheapest move is to make question seven moot. Process the file in the browser from start to finish and nothing is provided overseas, so none of the three transfer routes apply and the arguments in items five and six disappear with them. What remains is documentation rather than justification, which is why reviewers now ask whether a job can run on the device before asking anything else. Local workflows such as /blog/merge-pdf-no-upload simply have less to write up.

说明：下面是给工具选型和内部流程用的核对口径，不是法律意见。落到具体责任判断时，以本单位法务或外部律师的意见为准。

哪些 PDF 落在范围内 / What falls in scope

先划范围。个人信息指的是以电子或者其他方式记录的、与已识别或者可识别的自然人有关的各种信息，匿名化处理后的信息不算。落到 PDF 上，典型的几类是身份证或护照复印件扫描件、银行流水与征信报告、体检报告和化验单、含人脸的员工证照片、劳动合同与薪酬文件，以及把姓名和身份证号放在同一张表上的名单。判定标准不看文件格式，看内容里有没有能指向某个人的字段。

Scope first. Personal information means any information recorded electronically or otherwise that relates to an identified or identifiable natural person, excluding anonymised data. In PDF terms the usual suspects are scans of ID cards or passports, bank statements and credit reports, medical checkups and lab results, staff badge photos containing faces, employment contracts and payroll documents, and any roster pairing a name with an ID number. The test is not the file format, it is whether the content points at a specific person.

敏感个人信息是更高的一档：生物识别、宗教信仰、特定身份、医疗健康、金融账户、行踪轨迹，以及不满十四周岁未成年人的个人信息。这类信息在《个人信息保护法》下要单独同意，还要有更严格的保护措施，因此不能用和普通个人信息同一份清单糊过去。

Sensitive personal information sits one tier higher: biometrics, religious beliefs, specific identities, medical health, financial accounts, whereabouts, and the personal information of children under fourteen. It needs separate consent and stricter safeguards, so it cannot ride along on the same list as ordinary personal information.

敏感个人信息在 PDF 里的常见形态

• 医疗健康：病历、诊断书、检验单、影像报告导出的 PDF
• 金融账户：含账号的银行流水、信用卡账单、支付凭证截图转成的 PDF
• 生物识别：含人脸或指纹信息的门禁照、考勤表、身份核验截图
• 特定身份：少数民族成分、残障证明、工会会员信息一类的登记材料
• 未成年人：学生名册、儿童报名表、含出生日期的家庭关系证明

Four places a PDF hides identifiers

• Metadata: author, title and edit timestamps often still carry a name or the employer
• Attachments and layers: hidden layers, revision history and default values inside form fields
• File names and folder paths: a record number or a full name sitting in the file name
• Scanned pixels: letterheads, seals and signatures that no text search will find

合并会让范围判断变麻烦：两份单独看都只是普通信息的 PDF，合成一份后可能凑出完整的识别组合。这也是为什么第一步要在合并之前做，而不是导出之后补救。各层元数据在一次合并里的实际表现见 /blog/pdf-metadata-preservation-merge。

八项要求检查清单 / Eight requirements

下面这张表按顺序列出检查项、通过的样子和一眼能看出来的不合格信号。第三列最有价值，供应商的回答在这些地方通常含糊，而含糊本身就是答案。

The table lists each item, what passing looks like, and the signal that fails it at a glance. The third column earns its keep, because vague answers cluster there and vagueness is itself an answer.

第七行决定了其余七行的难度。从来没有文件离境，这一整块从论证变成一句陈述。第五、六行连同出境一起塌下去后，八项里实际需要写材料的只剩前四项。

Row seven sets the difficulty of the other seven. When nothing crosses a border the section collapses into a single statement, rows five and six go down with it, and only the first four lines still need writing.

同意与单独同意 / Consent and separate consent

一般的同意可以由多项处理活动列出后一次性取得，单独同意不行，它要求针对具体那一项单独告知并取得同意。落到 PDF 工具这个场景，需要单独同意的一共四类：处理敏感个人信息、向他人提供、公开、以及向境外提供。用一揽子授权覆盖这四类，等于没同意。

General consent can cover several listed processing activities at once. Separate consent cannot: it requires the specific item to be disclosed on its own and agreed to on its own. Four scenarios need it here: processing sensitive personal information, providing information to another party, making it public, and transferring it overseas. A blanket checkbox across all four is not consent.

四类单独同意场景在 PDF 处理里的对应关系

• 敏感个人信息：合并体检报告、门禁照、银行流水前单独告知用途并取得同意
• 向他人提供：把合并后的文件发给外部机构前，告知接收方名称、联系方式、处理目的与信息种类
• 公开：把招标公告、获奖名单这类含姓名的 PDF 挂到公网上之前
• 向境外提供：使用境外服务器处理前，除单独同意还要完成出境路径手续

Four separate consent scenarios mapped to PDF work

• Sensitive data: disclose the purpose and collect consent before merging checkups, badge photos or bank statements
• Providing to others: before sending the merged file out, name the recipient, contact details, purpose and data categories
• Making public: before posting files with names, such as tender notices or award lists, on the open web
• Transferring overseas: before using an offshore server, obtain separate consent and complete the transfer route as well

顺序上这里能省掉一半工作：先合并，再对着合成后的那一份做告知和收同意，比对每个源文件分别处理少一次遗漏的机会。

Order saves work here: merge first, then give one notice and take one consent for the combined file. Doing it per file doubles the effort and doubles the chance one gets missed.

数据出境：三条路径 / Leaving the country

只要文件被传到境外服务器处理，就属于向境外提供个人信息，需要在三条路径里走完一条。三条不是随便挑，门槛由处理者的类型和规模决定。

Once a file reaches an offshore server for processing, providing personal information overseas has happened and one of three routes must be completed. The route is not a free choice; the threshold depends on who the processor is and how much data they handle.

对 PDF 工具选型来说，这张表真正的用法是反过来读：先看能不能让第一列变成空白。浏览器本地处理的工具不产生出境环节，三条路径一条都不触发，出境对个人信息安全的影响这一类顾虑随之消失（背景见 /blog/pdf-data-export-impact）。能避开就避开，走流程的时间和材料成本都不低。

Read that table backwards when choosing a PDF tool: first ask whether the first column can be left empty. A browser-local tool never triggers any of the three routes, and the whole class of concern about exporting goes away, background in /blog/pdf-data-export-impact. Avoid it where you can, because the paperwork is not cheap.

三条路径的门槛和适用情形会随配套规定调整，落地前以主管部门最新发布的口径为准，不要用一两年前的理解做判断。

当天能跑的本地流程 / A workflow you can run today

把下面七步固定下来，一次做完，最后那页记录可以直接进供应商清单和个人信息保护影响评估档案。前三步解决范围判定，后四步解决能不能拿出证据。

Fix these seven steps once and the last page becomes the record that goes into the vendor list and the impact assessment file. The first three settle scope, the last four settle whether you can produce evidence.

1. 给待合并的文件分级：普通个人信息、敏感个人信息、已匿名化，结果写进清单或文件名
2. 确认处理方式：能在浏览器里跑完的工具，最先钝掉的第五到第七项直接变成零风险项
3. 需要单独同意的场景先补齐告知与同意，别在导出前临时拉取
4. 若确认有受托方或出境，向对方索取协议全文与接收方清单，拿不到就换下一家
5. 本地完成合并与页序调整，过程和结果都不经过第三方服务器
6. 导出前清一遍元数据：标题、作者、关键词、修改时间与隐藏图层
7. 把以上六条连同工具名、用途、保存期限和负责人签在同一页纸上归档

1. Classify the files: ordinary personal information, sensitive, or already anonymised, and record it in the manifest or file name
2. Decide how it gets processed; a browser-local tool turns items five through seven into non-issues first
3. Complete notice and separate consent where it applies, rather than collecting it at export time
4. If a processor or a transfer is involved, request the full agreement and the recipient list; move on if refused
5. Merge and reorder locally, with neither the process nor the result passing through anyone else's server
6. Before exporting, clear metadata: title, author, keywords, timestamps and hidden layers
7. Sign all six items with tool name, purpose, retention period and the responsible person, then file the page

合并这一步在 pdfmergenext.shop 全程本地完成，挑页码和调页序都不需要把含个人信息的文件交出去。这也是为什么本地工具和需要上传的工具不该放在同一张表上逐项比：前者在第五到第七行直接空着。架构上的差别见 /blog/client-side-vs-server-side-pdf-tools，零上传怎么实现见 /blog/how-zero-upload-pdf-tools-work，上一轮 GDPR 的同款清单见 /blog/gdpr-compliant-pdf-tools。

Merging on pdfmergenext.shop happens entirely on your device, so selecting pages and reordering never means handing files with personal information to anyone. That is why local and upload-required tools do not belong in the same comparison grid: rows five to seven are simply blank for the local route. The architectural difference is set out in /blog/client-side-vs-server-side-pdf-tools, the mechanics of zero upload in /blog/how-zero-upload-pdf-tools-work, and the GDPR version of this checklist in /blog/gdpr-compliant-pdf-tools.

更多 PDF 工具合规与隐私的判断细节见 /blog，医疗场景同時要对齐的要求见 HIPAA 合规 PDF 合并，本地方案的能力边界见 离线 PDF 合并的边界。