China Releases Final Personal Information Protection Standard

On January 2, the National Information Security Standardization Technical Committee released the final version of the "GB/T 35273-2017 Information Security Technology—Personal Information Security Specification" (source document in Chinese). The Personal Information Security Specification sets out best practices for enforcing China's data protection rules and applies to "personal data controllers" and those with the right to decide the purpose and method of processing personal information. The Personal Information Security Specification also protects "personal sensitive information," defined as information that may lead to bodily harm, property damage, reputational damage, harm to personal heath, or discriminative treatment if such data is disclosed, unlawfully provided, or abused. The law will take effect on May 1.