China approves new strict data privacy law as it continues to regulate cyberspace

Starting November 1, a new data privacy law will take effect in China. It will compel tech companies to collect less information to protect online users. They also should have a special person in charge of personal data protection.

The law was passed by China’s National People’s Congress, state media outlet Xinhua reported (via Reuters).

According to a new policy, tech companies will have to have a reasonable purpose to collect personal data, which should be limited to the “minimum scope necessary to achieve the goals of handling.” Handlers of this information will also have to conduct audits to ensure compliance with the law.

On top of that, companies should obtain a person’s consent for collecting data and implement special guidelines when this data is transferred outside China.

It is still unknown how the government will fine companies violating the new law. According to its draft version, penalties could reach ¥50 million (around $7.7 million) or 5% of annual income.