China’s Data Security Law and the Personal Information Protection Law are two key pieces of legislation in the field of information security following the adoption of the Cyber Security Law of the PRC. The Data Security Law provides framework and principles of data protection and sets the tone for administrative rules and regulations, while the Personal Information Protection Law establishes the principal legal basis for collecting and processing personal information and consolidates the personal data protection rules that were scattered across different laws and regulations. Each of the laws regulates the outflow of data and personal information from mainland China. Penalties for violating the Data Security Law could include fines ranging from RMB 100,000 to RMB 10 million, depending on the severity of the violation. Penalties for violating the Personal Information Protection Law could lead to confiscation of illegal gains and fines ranging from RMB 1 million to RMB 50 million or 5 percent of annual business turnover for the previous year.
