Like many countries around the world, China has shored up its data protection laws and regulations with the enactment of its Personal Information Protection Law (PIPL).
The law constitutes one of the most important pillars of the country's data protection legal regime, which includes a myriad of other laws — e.g., Cybersecurity Law (CSL) and Data Security Law (DSL) — and other industry-specific regulations and standards.
Notably, PIPL explicitly references China's Constitution and the Civil Code to provide a firmer legal basis for the implementation of its data protection objectives. As such, PIPL compliance should not be viewed in isolation but rather examined in relation to other regulatory requirements that serve complementary purposes.
PIPL mirrors Europe's General Data Protection Regulation (GDPR) in terms of many of its core requirements and penalties, which may make compliance easier for multinational organizations and corporations that have already established sufficiently robust data protection programs under existing law. However, some of PIPL's requirements are nuanced and different from GDPR and may require a refresh review of the existing company policies and procedures, which may create additional operational burdens. This article provides an overview of some of the key questions that many multinational organizations and corporations have been asking as they assess their PIPL readiness and plan for the most challenging aspects of compliance.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.