On 20 August 2021, the 13th Standing Committee of the National People’s Congress of the People’s Republic of China passed the Personal Information Protection Law (the PIPL).  The PIPL is the first comprehensive legislation on the protection of personal information in the PRC and it will take effect on 1 November 2021.

The PIPL has extraterritorial effect and applies to the personal information processing activities carried out both inside and outside mainland China.

Foreign individuals or organisations which process, outside mainland China, personal information of natural persons in the mainland China for the purposes of (i) offering products or services to natural persons in the mainland China, or (ii) analysing and assessing the behaviours of the natural persons in the mainland China will be subject to the PIPL.  Those individuals or organisations shall establish designated entities or appoint representatives in the mainland China to be responsible for matters relating to the protection of personal information.