Another Step Closer to Finalization: The Second Draft of China's Personal Information Protection Law

Once finalized, the PIPL, along with the Cybersecurity Law (中华人民共和国网络安全法) promulgated in 2016 and the Data Security Law (数据安全法) (which is also at the second-draft review stage), will form a more comprehensive legal regime of personal information protection and data security in China……

On April 29, 2021, the Standing Committee of the National People's Congress of China (the NPC) released the second draft of the PRC Law on the Protection of Personal Information (the PIPL) (中华人民共和国个人信息保护法), welcoming opinions from the general public until May 28, 2021. Compared with the first draft of the PIPL (published on Oct. 21, 2020), the second draft has largely taken into account public comments with significant amendments made to certain clauses in response to a number of public concerns.

Once finalized, the PIPL, along with the Cybersecurity Law (中华人民共和国网络安全法) promulgated in 2016 and the Data Security Law (数据安全法) (which is also at the second-draft review stage), will form a more comprehensive legal regime of personal information protection and data security in China, and will significantly impact companies and individuals handling the personal information of natural persons within the territory of China. It should be noted that, according to Article 3 of the second draft of the PIPL, where personal information handling happens outside of China, the PIPL will still apply where: (i) the purpose is to provide products or services to natural persons inside China; (ii) the activities of natural persons in China are being analyzed or assessed; or (iii) other circumstances provided for in PRC laws or administrative regulations apply.