China's New Personal Information Protection Law Setting New Grounds

The Standing Committee of the National People's Congress passed the Personal Information Protection Law of the PRC (“PIPL”) on 20 August 2021. The PIPL will take effect on 1 November 2021, and together with the Cybersecurity Law, Civil Code and Data Security Law, establish a comprehensive regulatory framework for data protection in China.

This article summarises key provisions of the PIPL and their potential impact.

Scope of application

The PIPL regulates not only the handling of personal information (“PI”) of natural persons within China, but also the PI handling activities outside of China for the purposes of i) providing goods or services to China-based individuals, or ii) relating to the behavioural analysis/assessment of Chinese residents, or iii) involving circumstances prescribed by laws or administrative regulations.