The State Administration for Market Regulation (SAMR) and
Standardization Administration of China (SAC) jointly published the
Information Security Technology – Personal Information
Security Specification (GB/T 35273-2020) (PI Specification)1
proposed by the National Information Security Standardization
Technical Committee (TC260) on March 6, 2020 as an amendment to and
replacement for the November 2017 version (GB/T 35273-2017).
The PI Specification will take effect on October 1,
2020.
Although the GB/T code indicates that it is a voluntary and
recommended rather than a mandatory document setting out best
practices concerning protection of personal information (PI),
Chinese regulators will likely expect that companies of all sizes
comply with the Information PI Specification with respect to
auditing and enforcement of the Cybersecurity Law (effective June
1, 2017) and proving compliance with laws and regulations in
government investigations and other
