What It Is

Personal Information Protection Law (PIPL) is China's comprehensive national regulation enacted in 2021, effective November 1. It governs collection, processing, storage, transfer, and deletion of personal information with extraterritorial reach. Modeled partly on GDPR, it uses a risk-based approach emphasizing consent, minimization, and security for domestic and foreign organizations handling data of individuals in China.

Key Components

• Eight chapters, 74 articles covering processing rules, cross-border transfers, individual rights, handler obligations.
• Core principles: lawfulness, necessity, minimization, transparency, accountability.
• Sensitive personal information (SPI) like biometrics, health requires explicit consent.
• Compliance via security assessments, SCCs, certifications; no broad legitimate interests basis.

Why Organizations Use It

• Mandatory for market access, avoiding fines up to 5% revenue or RMB 50M.
• Builds trust, enables data flows, reduces breach risks.
• Strategic for multinationals in e-commerce, fintech; enhances resilience, partnerships.

Implementation Overview

Phased: gap analysis, data mapping, policies, controls, audits (6-12 months). Applies universally to handlers; appoint China representatives for foreigners. No formal certification but CAC reviews, ongoing monitoring essential. (178 words)

What It Is

Cybersecurity Maturity Model Certification (CMMC) is a U.S. Department of Defense (DoD) certification program verifying cybersecurity protections for Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) across the Defense Industrial Base (DIB). It employs a tiered, risk-based model with three cumulative levels to ensure appropriate safeguards.

Key Components

• **Three levelsLevel 1 (17 FAR 52.204-21 practices), Level 2 (110 NIST SP 800-171 Rev 2 controls), Level 3 (+24 NIST SP 800-172 enhancements).
• 14 domains like Access Control, Incident Response, and Risk Assessment.
• Built on NIST standards and FAR clauses.
• Certification via self-assessments, C3PAO, or DIBCAC, using System Security Plans (SSPs) and limited POA&Ms.

Why Organizations Use It

• Mandatory for DoD contracts to gain eligibility and avoid debarment.
• Mitigates supply chain risks, reduces breach costs.
• Provides procurement advantages, builds stakeholder trust.
• Enhances operational resilience and maturity.

Implementation Overview

• **Phased approachScoping, gap analysis, remediation, assessment, sustainment.
• Targets DIB contractors/subcontractors handling FCI/CUI.
• Involves evidence collection, training, continuous monitoring; 3-year validity with annual affirmations. (178 words)