China Issues New National Standard On Security Requirements For Sensitive Personal Information

The State Administration for Market Regulation and the Standardization Administration of China have jointly issued a new national standard applicable to companies conducting business in China, GB/T 45574-2025, Data Security Technology – Security Requirements for Processing of Sensitive Personal Information (the Standard), which will take effect on November 1, 2025.

The data protection requirements outlined in the Standard align closely with those under China's Personal Information Protection Law (PIPL). Whereas the PIPL establishes foundational principles, the new Standard provides detailed operational guidance to ensure transparency, legitimacy, and necessity in data processing. It further refines these principles by establishing clear criteria for identifying sensitive personal information and providing specific definitions of sensitive data categories, thereby offering companies a more actionable framework for compliance.