Guest Author: Jasmine Zhao, a student at Loyola Law School.

On August 20, 2021, the Personal Information Protection Law (PIPL), regarded as China’s GDPR, was signed into law, and will become effective on November 1, 2021. The PIPL supplements China’s Cybersecurity Law and the Data Security Law, expanding China’s legal framework for the protection and regulation of data security and personal information. The PIPL has an extraterritorial scope, imposing broad disclosure, consent, and cross-border transfer obligations on organizations that provide products or services to or analyze activities of people within China.