China Releases Draft Personal Information Protection Law

On October 21, 2020 the Standing Committee of the National People's Congress published for public comment the first draft of the Personal Information Protection Law (PIPL). If passed, the PIPL would become China's first omnibus law regulating the collection and processing of personal information.

The draft PIPL proposes to codify many data privacy and protection principles and concepts that exist in China's current data governance regime, including the Cybersecurity Law¹ and the most recent version of the Personal Information Security Specification² (PI Security Specification), some of which, up until now, have not yet been firmly embodied in legislation. Perhaps most significantly for foreign businesses conducting or planning to conduct business in China involving the collection of personal information of individuals located in China, the draft PIPL proposes to have extraterritorial applicability and impose significant penalties for serious violations that are in