China

Personal Information Protection Law (PIPL) is currently operative and strictly enforced, serving as the bedrock on which China's data governance policy of China is built. Following the initial enforcement of the two in late 2021, the regulatory environment has since grown into one that sees extensive enforcement under the auspices of the Cyberspace Administration of China (CAC) and other sector-specific ministries, including the MIIT and MPS. The compliance framework takes into consideration the scale of operations of an organization with regard to how data is processed; mandatory audits are required for large-scale organizations handling data for more than 10 million individuals, whereas small-scale organizations follow a simpler reporting process. Cross-border data transfer activities are strictly regulated using formal mechanisms such as mandatory certifications for outbound transfers of data. Moreover, the legal framework continues to evolve, bolstered by ongoing legislative alignment efforts, such as amendments to the Cybersecurity Law to ensure that penalties have been harmonized and extended extraterritorially.