On 2 January 2018, the Standardization Administration of China (“SAC”) released the final draft of “Information Technology – Personal Information Security Specification” (National Standard GB/T 35273-2017) (GB/T 35273-2017 信息安全技 术个人信息安全规范) (“Specification”). The Specification came into effect on 1 May 2018. The Specification sets out the recommended practices on personal information protection. Although the Specification is not legally binding, compliance is expected by the PRC authorities and may be taken into account when assessing a company’s compliance with related laws (e.g. China’s Cybersecurity Law).
Continue Reading