Abstract

With the rise of the Internet, data have become one of the most valuable economic assets and, as a consequence, they have received special attention from lawmakers seeking to define the legal framework to regulate the flow of data and safeguard individuals from the risks associated with the processing and use of such data. China has also recently embarked on the path to define its data governance regime. A recent step in this direction was taken in 2021 with the enactment of the Personal Information Protection Law (PIPL). The aim of this paper is to analyse the legal framework of personal information protection within the Chinese legal system, focusing on the set of rules provided in the PIPL. After an introductory reconstruction of the concept and the meaning of “personal information” in the Chinese context, the paper focuses firstly on a general description of the main features of the new Law, and secondly on the most relevant provisions in regard to the transnational dimension of data flow, i.e., the territorial scope of the PIPL and the cross-border transfer of personal information.