It’s well-known that China’s data protection laws define sensitive personal information very differently to other jurisdictions. Instead of a closed list of data types, sensitive personal information in China has...more
While appointing and registering a DPO has been mandatory in China for many years, a portal has now finally been established for organisations to register those DPOs with the China data protection authority. This resolves...more
7/21/2025
/ China ,
Compliance ,
Cybersecurity ,
Data Controller ,
Data Privacy ,
Data Protection ,
Data Protection Authority ,
Personal Data ,
Registration Requirement ,
Regulatory Requirements ,
Reporting Requirements
On 14 March 2025, the Measures for the Labelling of Artificial Intelligence-Generated and Synthetic Content (Measures) was jointly released by four Chinese government agencies, namely the Cyberspace Administration of China,...more
Following Malaysia’s introduction of data breach notification and data protection officer (“DPO”) appointment requirements in last year’s significant amendments to the Personal Data Protection Act (“PDPA”) (click here for our...more
Chinese data regulators are intensifying their focus on the data protection compliance audit obligations under the Personal Information Protection Law (“PIPL“), with the release of the Administrative Measures for Personal...more
2/20/2025
/ China ,
Compliance ,
Data Privacy ,
Data Protection ,
Incident Response Plans ,
Personal Data ,
Personal Information ,
Personal Information Protection Law (PIPL) ,
Privacy Laws ,
Regulatory Agenda ,
Regulatory Requirements ,
Risk Management
On 3 January 2025, the Cyberspace Administration of China (“CAC“) released for public consultation the draft Measures for Certification of Personal Information Protection for Cross-Border Transfer of Personal Information...more
It’s the turn of South-East Asian countries to update their data protection laws. Here is our summary of the proposed new data protection laws in Vietnam, Malaysia and Indonesia. Organisations are advised to update their data...more
The Personal Information Protection Law (“PIPL“) requires a data controller to conduct compliance audits of its personal data processing activities on a regular basis (“Self-supervision Audits“). Apart from such...more
9/3/2024
/ Audits ,
China ,
Compliance ,
Data Privacy ,
Data Processors ,
Data Protection ,
Data Security ,
International Data Transfers ,
Personal Data ,
Personal Information ,
Personal Information Protection Law (PIPL) ,
Regulatory Requirements