China Enacts Strict Personal Information Protection Law With Global Reach
China officially passes the Personal Information Protection Law (PIPL), introducing strict data minimization rules and extra-territorial effects for foreign companies. The law takes effect November 1, 2021, requiring immediate compliance from businesses handling Chinese residents' data.
China officially passes the Personal Information Protection Law (PIPL) to establish strict rules for handling personal data. The law enforces a "minimum and necessary" principle, meaning companies only collect the exact amount of data required for a specific purpose. Even if a company obtains user consent, processing excessive data violates the PIPL.
The PIPL takes effect on November 1, 2021, without the lengthy grace period that many businesses previously expected. This immediate timeline forces companies operating in Mainland China to rapidly adjust their data compliance programs. It is important to note that this law only applies to Mainland China, leaving Hong Kong's existing data protection rules unaffected.
In a major shift, the PIPL applies extra-territorially to foreign companies processing Chinese residents' data. If an overseas entity provides goods or services to individuals in China or analyzes their behavior, it must comply with the new law. These foreign businesses face specific consent requirements and strict data localization mandates, marking a significant expansion of China's legal reach.