China’s Personal information Protection Law
On November 1, 2021, China’s new Personal Information Protection Law (PIPL) came into effect. The law applies to any company that processes personal information belonging to the citizens of the People’s Republic of China. The law aims to:
- Protect the rights and interests of individuals
- Regulate personal information processing activities
- Safeguard the lawful and “orderly flow” of data
- Facilitate reasonable use of personal information
Scope:
- The PIPL applies to organizations and individuals’ handling the personal information of natural persons within the borders of China
- The PIPL also extends its application scope to processing activities by handlers established outside of China, if one of the following circumstances is present
- Where the purpose is to provide products or services or natural persons inside of China’s borders
- Where conducting analysis or assessment of activities of natural persons inside China’s borders
Enforcements
- The fine can be up to 50 million RMB or 5 percent of an organization’s annual revenue/turnover for the prior financial year
- Violations may also be recorded into the “credit files” of the processing entity under China’s national social credit system
The full guidelines can be found
here