The Chinese Personal Information Protection Law (PIPL) is a comprehensive data privacy law that was passed by the Standing Committee of the National People’s Congress on August 20, 2021, and came into full effect on November 1, 2021.
The PIPL is the first national-level data privacy law in China and is designed to regulate the collection, use, processing, and transfer of personal information by both public and private entities.
Under the PIPL, individuals have the right to know and consent to the collection and use of their personal information, and have the right to request that their personal information be deleted, corrected, or suspended. The law also requires organizations to implement measures to protect personal information, including implementing security measures and appointing a data protection officer.
One of the most significant features of the PIPL is its extraterritorial reach, which means that it applies to any organization that processes the personal information of individuals within China, regardless of where the organization is located. This includes organizations outside of China that offer goods or services to individuals within China or analyze the behavior of individuals within China.
Overall, the PIPL is seen as a major step forward for data privacy in China and is expected to have a significant impact on businesses operating in China, as well as those outside of China that process personal information related to Chinese individuals.
Rights according to the PIPL
The Chinese Personal Information Protection Law (PIPL) guarantees several rights for individuals regarding their personal information. These include:
- Right to be informed: Individuals have the right to be informed about the collection, use, and storage of their personal information.
- Right to access and correct: Individuals have the right to access and correct their personal information held by organizations.
- Right to deletion: Individuals have the right to request the deletion of their personal information under certain circumstances, such as when the information is no longer necessary for the purpose for which it was collected or when it was collected illegally.
- Right to object: Individuals have the right to object to the processing of their personal information in certain situations, such as when the processing is for direct marketing purposes.
- Right to portability: Individuals have the right to receive their personal information in a structured, commonly used, and machine-readable format and to transfer that information to another organization.
- Right to withdraw consent: Individuals have the right to withdraw their consent to the processing of their personal information at any time.
