What It Is

PIPL (Personal Information Protection Law) is China's comprehensive national regulation enacted in 2021, governing collection, processing, storage, transfer, and deletion of personal information. It applies domestically and extraterritorially to organizations targeting individuals in China, using a risk-based approach emphasizing consent, minimization, and security, alongside Cybersecurity Law and Data Security Law.

Key Components

• Core principles: lawfulness, necessity, minimization, transparency, accountability.
• Sensitive personal information rules, individual rights (access, deletion, portability), cross-border mechanisms (security assessments, SCCs, certification).
• 74 articles across 8 chapters; no certification but mandatory compliance with audits and impact assessments.

Why Organizations Use It

PIPL ensures legal compliance amid fines up to 5% annual revenue, mitigates operational disruptions, builds consumer trust in China's digital economy, enables market access, and enhances data governance resilience.

Implementation Overview

Phased approach: gap analysis, data mapping, policy updates, controls, monitoring. Applies to all sizes handling Chinese data; requires in-country representatives for foreigners. Ongoing audits and training essential, typically 6-12 months initial rollout.

What It Is

ISO 13485:2016, officially Medical devices — Quality management systems — Requirements for regulatory purposes, is an international certification standard for QMS in medical devices. It ensures organizations consistently provide safe devices meeting customer and regulatory requirements across the lifecycle (design to disposal). Employs a risk-based process approach with documented controls and validation.

Key Components

• Clauses 4–8 cover QMS/documentation (4), management responsibility (5), resources (6), product realization (7), measurement/improvement (8).
• Emphasizes design controls, traceability, validation, post-market surveillance, CAPA.
• Builds on ISO 9001 but adds med-device specifics like regulatory integration.
• Third-party certification via accredited bodies with stage audits.

Why Organizations Use It

• Enables market access (EU MDR, FDA QMSR alignment by 2026).
• Reduces risks, recalls, compliance costs.
• Builds supplier assurance, stakeholder trust.
• Provides competitive edge in partnerships.

Implementation Overview

• Phased: gap analysis, documentation, training, validation, audits.
• Suits manufacturers, suppliers globally; scalable by size.
• Involves eQMS, risk management (ISO 14971), internal audits.