What It Is

NIS2 (Directive (EU) 2022/2555) is an EU regulation expanding the original NIS Directive. It establishes a high common level of cybersecurity resilience for critical infrastructure and digital services across member states. Adopting a risk-based approach, it targets essential and important entities in expanded sectors like energy, transport, and cloud computing.

Key Components

• **Risk managementOngoing assessments, supply chain security, access controls, encryption.
• **Incident reportingEarly warning (24 hours), detailed report (72 hours), final report (1 month).
• **Business continuityRecovery plans and crisis procedures.
• **Corporate accountabilitySenior management responsibility. Built on standards like ISO 27001; focuses on continuous assurance via spot checks, no formal certification.

Why Organizations Use It

Mandatory for medium/large entities in covered sectors to avoid fines up to 2% global turnover. Enhances resilience against threats, ensures service continuity, builds stakeholder trust, and supports cross-border cooperation.

Implementation Overview

Assess applicability by size/sector, implement risk measures, establish reporting/governance. Tailor to national transpositions (by Oct 2024). Involves training, audits, tech upgrades; ongoing for multi-state operations. (178 words)

What It Is

Personal Information Protection Law (PIPL) is China's first comprehensive national regulation governing personal information processing. Enacted in 2021, it protects natural persons' rights through collection, use, storage, transfer, and deletion rules. Modeled partly on GDPR, it adopts a risk-based approach with extraterritorial scope for foreign entities targeting China.

Key Components

• Eight chapters, 74 articles covering processing rules, cross-border transfers, individual rights, handler obligations.
• Core principles: lawfulness, necessity, minimization, transparency, accountability.
• Sensitive personal information (SPI) rules, consent defaults, no broad legitimate interests basis.
• Compliance via security assessments, SCCs, certifications; enforcement by CAC with fines up to 5% revenue.

Why Organizations Use It

• Mandatory for China operations or data; avoids RMB 50M fines, suspensions.
• Builds trust, enables market access, reduces breach risks.
• Strategic for MNCs in e-commerce, fintech; enhances resilience, talent attraction.

Implementation Overview

• Phased: gap analysis, data mapping, policies, controls, audits (6-12 months).
• Applies globally to China data handlers; suits all sizes, high-risk sectors.
• No formal certification but CAC reviews, internal audits required.