2026-08-28
China's Network Data Security Regulation (State Council Order 790) took effect on 1 January 2025, turning the Cybersecurity Law, Data Security Law and PIPL into operational, enforceable obligations for...
2026-08-28
In August 2026 Guangzhou, Shenzhen and the Guangdong-Macao In-Depth Cooperation Zone in Hengqin were selected as the first batch of national pilot zones for international cooperation in the data...
2026-08-28
The standard contract is the second of PIPL's three export routes: sign with the overseas recipient, then file with the provincial cyberspace administration. 标准合同是《个保法》三条出境路径中的第二条：与境外接收方签约，再向省级网信部门备案。Eligibility is fixed by volume...
2026-08-28
China's third data-export route opened on 1 January 2026 under CAC and SAMR Order No. 20. 第20号令使个人信息保护认证成为可用通道，2026年1月1日起施行。Eligibility is narrow: non-CIIO handlers, 100,000 to under 1m individuals' non-sensitive data...
2026-08-28
PIPL took effect on 1 November 2021 and has extraterritorial reach, binding overseas processors that handle personal information of individuals in China. 《个人信息保护法》于2021年11月1日施行，并具有域外效力（第三条），约束处理中国境内自然人个人信息的境外处理者。Processing requires a documented lawful basis...
Cybersecurity / 网络安全, PIPL Compliance / 个保法合规
2026-08-28
The Measures for Network Data Security Risk Assessment, jointly issued by the CAC, MIIT and MPS, took effect on 20 August 2026. 由国家网信办、工业和信息化部、公安部联合制定的《网络数据安全风险评估办法》于 2026 年 8 月 20...
2026-08-28
The Personal Information Protection Law gives three cross-border paths — security assessment, standard contract, and certification — all now operable after the 2026 Certification Measures took effect on 1...
2026-08-28
Cross-border transfers of employee personal information are exempt from the security-assessment, standard-contract and certification routes where they implement cross-border HR management under a duly adopted labour rule or collective...
2026-08-28
PIPL creates two distinct governance roles: a personal information protection officer (PIPO) under Article 52, and a domestic dedicated institution or designated representative for overseas processors under Article 53....
2026-08-28
The CAC's January 2026 draft "Rules on Personal Information Collection and Use by Internet Applications" codifies consent, separate consent for sensitive data, and minimal collection for apps, SDKs, distribution...