Getting Prepared For The First Personal Information Protection Law In China

Big data analytics for many companies is crucial to identify personal consumption characteristics and increase sales. However, many consumers may oppose such practice since companies can mishandle personal information.

The Personal Information Protection Law of the People's Republic ("PIPL") takes effect from 1 November 2021 and is the first law to address misuse of personal data. Companies engaged in processing the personal information of individuals located in China are obliged to implement necessary measures.

Below, we highlight the mandatory requirements for foreign companies under the PIPL.

1. User Consent

Under PIPL, companies may only collect personal information when the individual's consent is obtained. The consent shall be voluntary and the individual shall be explicitly informed. Individuals can request how their personal information is collected, stored, and require such information to be corrected and deleted.