What It Is

Personal Information Protection Law (PIPL) is China's comprehensive national regulation enacted in 2021, effective November 1. It governs collection, processing, storage, transfer, and deletion of personal information of individuals in China. Modeled partly on GDPR, it uses a risk-based approach emphasizing consent, minimization, and security, with extraterritorial reach.

Key Components

• Core principles: lawfulness, necessity, minimization, transparency, accountability.
• Rules for processing, cross-border transfers, individual rights.
• Sensitive PI categories like biometrics, health data.
• Mechanisms: SCCs, security reviews, certification; no broad legitimate interests basis.
• Compliance via governance, PIPIAs, audits.

Why Organizations Use It

• Mandatory for entities handling China data to avoid fines up to 5% revenue.
• Enables market access, builds trust, reduces breach risks.
• Strategic for multinationals in e-commerce, fintech, healthcare.

Implementation Overview

Phased: gap analysis, data mapping, policies, controls, transfers. Applies globally to China-exposed orgs; requires China representatives for foreigners. No formal certification but CAC audits/enforcement.

What It Is

The Privacy Act 1988 (Cth) is Australia's foundational federal privacy regulation. It provides a principles-based framework regulating the handling of personal information by government agencies and private sector organizations exceeding AUD $3 million turnover, covering collection, use, disclosure, security, and individual rights across the data lifecycle.

Key Components

• **13 Australian Privacy Principles (APPs)Core rules on transparency (APP 1), collection (APP 3), cross-border disclosure (APP 8), security (APP 11), and access/correction (APPs 12-13).
• **Notifiable Data Breaches (NDB) schemeMandatory reporting of eligible breaches likely causing serious harm.
• **OAIC enforcementInvestigations, audits, civil penalties up to AUD $50M.

Why Organizations Use It

• Meets legal obligations for in-scope entities, including extraterritorial reach.
• Mitigates breach risks, enhances data governance, and facilitates transborder flows.
• Builds stakeholder trust, reduces reputational damage, and supports competitive advantage.

Implementation Overview

• **Phased risk-based approachGap analysis, policy development, controls (security, vendor management), training, and NDB readiness.
• Applies to medium-large organizations, health providers, across Australia; no certification but OAIC assessments required.