The Standardization Administration of China has published the Information Security Technology Personal Information Security Specification that goes into effect on May 1, 2018. The Specification is voluntary and establishes benchmarks for the processing of personal information by entities and organizations. It constitutes a best practice guide for the collection, retention, use, sharing and transfer of personal information, and for the handling of information security incidents. The Specification requires entities to clarify which of their departments and staff would be responsible for the protection of personal information, and to establish a system to evaluate impacts on the security of that personal information.
