China’s New Privacy Law: Everything You Need to Know

Last August, China’s National People’s Congress passed a new law designed to protect the online privacy of Chinese citizens titled the “Personal Information Protection Law”. The new law – which went into effect on November 1, 2021 – requires that any website or application that collects personal data from its users must have a clear and reasonable purpose for doing so and that their usage of that personal data must be limited to the minimum scope necessary to achieve this clear and reasonable purpose.

In addition to requiring that companies only utilize the personal data of their customers for clear and reasonable goals, the Personal Information Protection Law passed by China’s National People’s Congress also requires that companies obtain consent before collecting personal data from a customer and sets forth guidelines for how data should be protected if it is transferred to a country outside of China.

While China’s passage of the Personal Information Protection Law is aligned with increased efforts across the globe to bolster online privacy and data security, it has also arrived at a time when many Chinese companies are already struggling to cope with broader regulatory tightening by the Chinese government. From anti-monopoly policies to data security policies to industry-specific regulations, the Chinese government has tightened its grip on the economy across the board in a number of different ways over the past couple of years. This has led to increased volatility in the Chinese market and concerns among investors that over-regulation will stifle the country’s economic growth.

On its own, however, the Personal Information Protection Law is poised to create a more private and secure online environment for Chinese citizens – even if the companies responsible for upholding this new law are struggling to bear the burden.