It was recently announced that China has approved a new law that aims to protect personal data.

Indeed, the new ‘Personal Information Protection Law of the People’s Republic of China’ will be coming into effect on November 1st of this year. It will outline how and when data is collected and managed, what are each individual’s rights, and who owns data. It will refine the principles and personal information processing rules to be followed as well as clarify the boundaries of rights and obligations in personal information processing activities.

Moreover, the law will set the regulations for data flows and processing and the role of state agencies within it. The continuous consent of collection of data is vital in China and thus, this legislation will need continual updates on the full consent of every person. It underlines that parties gathering data won’t be able to require excessive information nor refuse products or services if the individual didn’t agree to it. Besides, each individual can withdraw consent.

It was stated that information processors must ensure the security of all personal information processed and set up compliance management systems and internal audits. In order to collect sensitive and personal data, there must be an impact assessment as well as a process to inform the individual.

The new legislation also aims to prevent companies from using big data to spy on consumers or mislead consumers based on their individual characteristics or habits. Hence, organizations must provide clarity on how data is protected and secured.