protection officer, and report the name, contact information and other information of such officer to the authorities performing personal information protection duties. Article 53 Personal information processors outside the territory of the People's Republic of China as specified in the second paragraph of Article 3 of this Law shall establish a special agency or appoint a representative within the territory of the People's Republic of China to be responsible for personal information protection-related affairs, and submit the name of such agency or the name and contact information of the representative to the authorities performing personal information protection duties. Article 54 Personal information processors shall have the compliance of their activities of processing of personal information with laws and administrative regulations audited on a regular basis. Article 55 Under any of the following circumstances, personal information processors shall conduct a personal information protection impact assessment before the event, and keep a record of the processing: 1. Processing of sensitive personal information; 2. Use of personal information in automated decision-making; 3. Contracting of the processing of personal information to another party, provision of personal information to another personal information processor, or disclosure of the personal information; 4. Provision of personal information to an overseas recipient; or 5. Any other activity of processing of personal information of an individual that will have a material impact on personal rights and interests. Article 56 A personal information protection impact assessment shall cover the following: 1. Whether the purpose, method or any other aspect of the processing of personal information is lawful, legitimate and necessary; 2. The impact on personal rights and interests and level of risk; and 3. Whether any security protection measure taken is lawful, effective and commensurate with the level of risk. Personal information protection impact assessment reports and records of processing shall be retained for at least three years. Article 57 For any leakage of, tampering with, or loss of personal information that occurs or may occur, a personal information processor shall immediately take remedial measures, and notify the authorities performing personal information protection duties and any individual concerned of matters including the following: 1. The type of personal information to which the leakage, tampering with, or loss occurs or may occur, the cause of such event or potential event, and the harm that may be caused; 2. Any remedial measure taken by the personal information processor, and any measure that can be taken by the individual to mitigate the harm; and 3. The contact information of the personal information processor. The personal information processor may be allowed not to notify the individual concerned if the personal information processor can take measures to effectively avoid harm caused by the leakage of, tampering with, or loss of information; however, the authorities performing personal information protection duties may require the personal information processor to notify the individual if they believe that harm may be caused to the individual. Article 58 Personal information processors who provide an important internet platform service, have a large user base or operate a complex type of business shall perform the following obligations: 1. Establishing a sound personal information protection compliance policy and system in compliance with the regulations of the State, and establishing an independent body that is mainly composed of external members to supervise their protection of personal information; 9