What It Is

Personal Information Protection Law (PIPL) is China's comprehensive national regulation, effective November 1, 2021, governing collection, processing, storage, transfer, and deletion of personal information. It applies domestically and extraterritorially to organizations targeting Chinese individuals, using a risk-based approach with consent-centric principles, alongside Cybersecurity Law and Data Security Law.

Key Components

• Eight chapters, 74 articles covering processing rules, cross-border transfers, individual rights, handler obligations.
• Core principles: lawfulness, necessity, minimization, transparency, accountability.
• Sensitive personal information (SPI) like biometrics, health data requires explicit consent.
• Compliance via security assessments, standard contractual clauses, certifications; no broad legitimate interests basis.

Why Organizations Use It

PIPL compliance mitigates fines up to 5% annual revenue, enables market access in China, builds customer trust, reduces breach risks, and supports cross-border operations. It enhances resilience, aids M&A, and positions firms competitively in digital economy.

Implementation Overview

Phased approach: gap analysis, data mapping, policy development, controls, audits (6-12 months). Applies to multinationals, domestic firms handling PI; requires PIPO appointment, PIPIAs for high-risk activities. No formal certification but CAC enforcement via audits, penalties.

What It Is

RoHS (Directive 2011/65/EU, recast as RoHS 2) is an EU regulation restricting hazardous substances in electrical and electronic equipment (EEE) to protect health and environment during waste management. It employs an open-scope approach (all EEE unless excluded) with homogeneous material concentration limits and time-limited exemptions.

Key Components

• Restricts 10 substances (e.g., Pb, Hg, Cd, Cr(VI), phthalates) at 0.1% (0.01% for Cd) in homogeneous materials.
• Annex I categories (11 EEE types); Annexes III/IV for exemptions.
• Built on CE-marking framework; requires technical documentation and EU Declaration of Conformity (DoC).
• Compliance via IEC 63000 documentary methods and IEC 62321 testing.

Why Organizations Use It

• Mandatory for EU market access; prevents recalls, fines.
• Enhances recyclability, supply chain governance, ESG reporting.
• Reduces risks from exemptions expiry, global variants (e.g., China RoHS 2).
• Builds stakeholder trust, competitive edge in sustainability.

Implementation Overview

• **Phased approachscoping, gap analysis, supplier controls, testing, documentation.
• Applies to manufacturers/importers of EEE; all sizes, global reach.
• No central certification; market surveillance audits technical files (10-year retention).