China Targets Data Collectors With New GDPR-Aligned National Standards

Chinese regulators have finalized new national standards for the collection and storage of personal information. The new comprehensive document provides granular detail of how businesses should obtain customer consent, design personalized displays, and store biometric information, as well as provides internal governance best practices.

Lawyers recommend businesses comply fully with the standards outlined in the updated Information Security Technology - Personal Information Security Specification (信息安全技术个人信息安全规范) despite its non-binding legal status. That is because various regulators including the Cyberspace Administration of China (CAC) as well as third-party assessment bodies are using it as a yardstick for measuring compliance with general personal information protection rules and regulations.