The State Administration for Market Regulation (SAMR) and
Standardization Administration of China (SAC) jointly published the
Information Security Technology – Personal Information
Security Specification (GB/T 35273-2020) (PI
Specification)1 proposed by the National Information
Security Standardization Technical Committee (TC260) on March 6,
2020 as an amendment to and replacement for the November 2017
version (GB/T 35273-2017). The PI Specification will take
effect on October 1, 2020.
Although the GB/T code indicates that it is a voluntary and
recommended rather than a mandatory document setting out best
practices concerning protection of personal information (PI),
Chinese regulators will likely expect that companies of all sizes
comply with the Information PI Specification with respect to
auditing and enforcement of the Cybersecurity Law (effective June
1, 2017) and proving compliance with laws and regulations in
government investigations and other
