In many aspects, the Personal Information Protection Law (PIPL), which became effective on November 1, 2021, looks very similar to the EU's General Data Protection Regulations (GDPR). However, many of these similarities remain as high-level principles under the PIPL, while more detailed content has been rolled out step by step. Earlier this year, the Cyberspace Administration of China (CAC), established export security assessment procedures and Standard Contractual Clauses (SCCs) for data exports. Now, the CAC is shifting its focus to compliance audits. On August 3, 2023, the CAC presented the draft Administrative Measures for Compliance Audit of Personal Information Protection (Draft Audit Measures) soliciting public comments. For Data Protection Officers (DPOs) and compliance officers, this topic will become another important task to include in their planning for implementation in 2024.

In this Insight article, Julian Sun, from Taylor Wessing, delves into the key provisions of the Draft Audit Measures and sheds light on the evolving compliance audit framework, highlighting its importance, nuances, and potential impacts for companies operating in China.

The requirements for personal information protection in the health and pharmaceutical industries are complex. Danjun Wu, Partner at Guantao Law Firm, provides a two-part overview: part one introduces the basic requirements for personal information protection to be met by medical institutions and pharmaceutical companies, and part two introduces the specific protection obligations to be fulfilled by medical institutions and pharmaceutical companies in the key contexts of processing personal information.

Since 2021, in the wake of the Provisional Regulations on Data Security Management of the Automotive (the Automotive Data Regulations), and under the purview of China’s data protection legislation landmark legislations - the Data Security Law (DSL) and the Personal Information Protection Law (PIPL), data protection and cybersecurity concerns have become increasingly prominent in the automotive industry. The strengthened rules in processing automotive data impose challenges for automotive companies, especially in the process of human-machine interaction, e.g., the function of 360° panoramic camera, interior remote monitoring, remote intelligent parking, etc. In this article, Sherry Gong and Tong Zhu, from Hogan Lovells, look at the key compliance requirements and challenges for automotive companies to consider when navigating data protection in China.

On 2 December 2022, the Communist Party of China ('CPC') Central Committee and the State Council jointly released the Opinions on Building Basic Systems for Data to Better Play the Role of Data Factors ('the Opinions'), in order to speed up efforts to build basic systems for data, give full play to China's strengths in massive-scale data and rich application scenarios, and stimulate the potential of data factors. Dr. Annie Xue and Yang Chen, from GEN Law Firm, outline the key takeaways from the Opinions.