China PIPL Overview Infographic

Create a free account to access. Already a member?Log In.

On August 20, 2021, China’s Personal Information Protection Law (PIPL) was adopted by the National People’s Congress (NPC) Standing Committee. The PIPL took effect on November 1, 2021, and will regulate the collection and usage of personal information by companies operating in China. Under the PIPL, data subjects have a greater level of protection and control over their personal information including eight individual rights.

The PIPL outlines that personal information should be processed within the “minimum scope necessary” and introduces a concept similar to that of the Data Protection Officer. This means that organizations should appoint an individual to take charge of personal information protection operations.

The PIPL also includes several provisions that are similar to the GDPR including:

Guidelines for the international transfer of data
Options to reject business marketing particularly where marketing is targeted to personal characteristics
Requirements to obtain consent for processing sensitive personal information which includes:
- Biometrics
- Medical & Health data
- Financial accounts, and
- Geolocation

Read the OneTrust Blog: China’s Personal Information Protection Law to Take Effect November 1, 2021