China

CAC is the primary regulator. Sector regulators (PBOC, MIIT) also have jurisdiction.

Individual consent is one of several bases. Separate consent required for sensitive data, cross-border transfer, and provision to third parties.

Rights to know, decide, restrict, refuse, access, copy, correct, delete, and portability.

Strict rules: security assessment by CAC, standard contracts, or certification. Important data must undergo security assessment.

Must notify authorities and individuals. Remedial measures required immediately.

Personal information protection officer required for organisations processing above volume thresholds.

Parental consent required for children under 14. Classified as sensitive personal information.

Up to RMB 50 million or 5% of annual revenue. Responsible individuals can be fined and banned from executive positions.

Cybersecurity Law, Data Security Law, financial data rules, automotive data rules, health data regulations.

General consent requirements apply. Mobile app regulations impose specific requirements.

Right to refuse automated decisions. Regulations on algorithmic recommendations, deep synthesis (deepfakes), and generative AI.

Critical Information Infrastructure Operators must store data locally. Important data subject to security assessment for export.

Concept of "important data" and CII operators triggers enhanced obligations.

State organs have specific obligations under PIPL. National security exemptions apply.