Chairman’s Order No. 91
The “Personal Information Protection Law of the People’s Republic of China” was adopted by the 30th meeting of the Standing Committee of the 13th National People’s Congress of the People’s Republic of China on August 20, 2021, is hereby promulgated, and came into force on 1 November 2021.
(Adopted at the 30th meeting of the Standing Committee of the 13th National People’s Congress on August 20, 2021)
This Law is enacted in accordance with the Constitution to protect personal information rights and interests, regulate the processing of personal information, and promote the reasonable use of personal information.
The personal information of any natural person shall be protected by law, and no organization or individual may infringe upon the personal information rights and interests of any natural person.
This Law shall apply to the processing of the personal information of natural persons within the territory of the People’s Republic of China.
This Law shall also apply to the activities carried out outside the territory of the People’s Republic of China to process the personal information of natural persons within the territory of the People’s Republic of China under any of the following circumstances:
(I) where the purpose is to provide products or services to domestic natural persons;
(II) where the purpose is to analyze and evaluate the activities of domestic natural persons; and
(III) other circumstances provided by laws and administrative regulations.
Personal information refers to various kinds of information related to identified or identifiable natural persons recorded by electronic or other means, excluding the information processed anonymously.
Processing of personal information includes the collection, storage, use, processing, transmission, provision, publication, and erasure of personal information.
Personal information shall be processed in accordance with the principles of legality, legitimacy, necessity, and good faith, and shall not be processed by misleading, fraud, coercion, or other means.
Processing of personal information shall be for a definite and reasonable purpose, shall be directly related to the purpose of processing, and shall be processed in a manner that has the least impact on individual rights and interests.
Collection of personal information shall be limited to the minimum scope for the purpose of processing and excessive collection of personal information shall not be allowed.
Processing of personal information shall follow the principles of openness and transparency, disclose the rules for processing personal information, and expressly indicate the purpose, manner, and scope of processing.
When processing personal information, the quality of personal information shall be guaranteed to avoid adverse effects on personal rights and interests caused by inaccurate and incomplete personal information.
Personal information processors shall be responsible for their processing of personal information and take necessary measures to ensure the security of the personal information they process.
