- The new law takes effect on 1 November, barely ten weeks after approval and with no long transition period.
- It has extraterritorial reach: it affects anyone who processes data on people in China from abroad.
- It demands consent and strict conditions for transferring data out of the country.
On 20 August 2021 the Standing Committee of China’s National People’s Congress passed the Personal Information Protection Law, known by its English initials as the PIPL. It will take effect on 1 November 2021, without the long adjustment period many had expected, and joins the Cybersecurity Law and the Data Security Law, which takes effect on 1 September.
Many analysts compare it with the European General Data Protection Regulation (GDPR): it recognises rights for individuals, requires a legal basis to process data and provides for fines of up to 50 million yuan or 5 % of the previous year’s turnover. But it does so with its own approach, in which national security and the role of the State in managing data weigh heavily. Unlike in Europe, there is no independent data protection authority: enforcement falls mainly on bodies such as the Cyberspace Administration.
What the law requires
The PIPL starts from principles that will be familiar to anyone who knows the GDPR: specific purpose, data minimisation and transparency. It requires informed consent to process personal information in many cases, separate consent for sensitive data and the possibility of withdrawing it at any time. It also recognises rights of access, correction and deletion. For the data of children under 14 it also requires the consent of their parents or guardians.
It also requires impact assessments for higher-risk processing, such as sensitive data, transfers abroad or automated decisions. For companies this means documenting what data they handle, on what basis and for how long, and being able to prove it to the Chinese authorities. Penalties can also reach the individuals responsible within the company.
Reach outside China
The law applies not only to processing inside the country but also to processing abroad when its purpose is to offer products or services to people in China or to analyse their behaviour. Foreign entities in that situation will, in general terms, have to appoint a representative or an entity in Chinese territory.
Transfers of data abroad will be subject to conditions: a security assessment, a certification or a standard contract, in addition to the person’s specific consent. For certain operators and volumes of data it may even be required that the information be kept in China. In addition, foreign authorities will not be able to access data stored in China without the prior approval of the Chinese authorities. Implementing rules are still needed to settle the details.
What to review
European companies, including many Catalan ones, that sell to Chinese customers, have subsidiaries or employees in the country, run e-commerce platforms or depend on suppliers there should take an inventory of the personal data they handle and where it is stored, including human-resources data on employees in China that is sent to European headquarters. Contracts with suppliers and subsidiaries also deserve review. They should include clear clauses on who is responsible for each processing activity.
Complying with the GDPR helps, but it is not enough: legal bases, deadlines and localisation obligations do not match. The same processing may be lawful in Europe and require specific consent, an assessment or additional authorisation in China. Until the implementing rules are known, the prudent course is to take 1 November as the reference date and consult a specialist adviser. It is best to do so before November, when the law becomes enforceable.
Complying in Europe is not the same as complying in China.
This article is general information. It is not legal, tax or investment advice, and it does not take anyone’s particular circumstances into account.
