The PRC Personal Information Protection Law and its Regulatory Impact on Multinational Entities

Summary

---

|

• The PIPL marks a key step forward in regulation of personal information rights of individuals
• The PIPL sets out fundamental principles as well as a legal and regulatory framework
• The PIPL applies to any processor of the personal information of Chinese natural persons, and can therefore apply to multinational companies based outside of China
• Foreign companies should also take note of the cross-border transfer requirements in relation to personal information

On August 20, 2021, the 30th session of the Standing Committee of the 13th National People's Congress (the NPC) passed the PRC Law on the Protection of Personal Information (the PIPL) (中华人民共和国个人信息保护法). The law takes effect on Nov. 1, 2021. The PIPL contains eight parts and 74 articles, and sets out among other things, the general data protection principles, rules for processing personal information (PI), rights of the individual concerned in the processing of PI, the obligations of the PI handlers (个人信息处理者), and the regulatory authority for regulating processing of PI and protecting PI.

In recent years, China has been active in legislating and regulating the security of data and PI protection