The long-expected Personal Information Protection Law of China
("PIPL") was passed on 20 August 2021, at the 30th
Session of the Standing Committee of the 13th National People's
Congress, and will come into effect on 1 November 2021. As the
Chinese equivalent of GDPR, the PIPL will change the current
landscape of scattered provisions on personal data protection, by
clarifying the rules for processing personal data, the obligations
of data handlers and processors, and the rights of data subjects.
Notably, the fine would be up to 5% of annual turnover, thus even
exceeding GDPR.
This Guide aims to help entities in China, as well as those
established outside China but subject to the extraterritorial
effect of the PIPL, carry out data compliance work to get prepared
for the upcoming law. Each section of this Guide describes an
important rule or requirement under the PIPL. We also provide
suggested actions at the end of each section for your
reference.
