Digital Policy Alert logo

China: Shanghai Data Regulations including data protection regulation implemented

Policy overview

Description

Shanghai Data Regulations including data protection regulation implemented

On 1 January 2022, the Shanghai Data Regulations have entered into force. The Regulations lay out the conditions under which rights to data and privacy must be respected. Notably, the collection or processing of personal information requires individ…

Scope

Policy Area
Data governance
Policy Instrument
Data protection regulation
Regulated Economic Activity
cross-cutting
Implementation Level
subnational
Government Branch
executive
Government Body
central government

Complete timeline of this policy change

Hide details
2021-09-30
in consultation

On 30 September 2021, the Shanghai Municipal Government announced the publication of the draft Shan…

2021-10-20
processing consultation

On 10 October 2021, the Shanghai Municipal Government closed the consultation on the draft Shanghai…

2021-11-29
adopted

On 29 November 2021, the Shanghai Municipal Government adopted the Shanghai Data Regulations. The R…

2022-01-01
in force

On 1 January 2022, the Shanghai Data Regulations have entered into force. The Regulations lay out t…

Key regulatory dimensions

Regulated subjects

The businesses, government agencies or individuals affected by this policy or regulatory change.
producer / supplier
1
Type Private organisation
Economic activity cross-cutting
Category All

Policy change by business practice

The detailed activities within the scope of this policy or regulatory change.
personal data: biometric: data collection
Regulatory tool
User right to rectification of personal data
User right to deletion of personal data
User right to withdraw consent
Preventive security requirement
Regulator notification requirement
Purpose/processing limitation
User consent: Opt-in requirement
Sanctions
TBR - Existing statutory sanction
Regulated subjects
1
personal data (all forms): storage (any form)
Regulatory tool
User right to rectification of personal data
User right to deletion of personal data
User right to withdraw consent
Preventive security requirement
Regulator notification requirement
User consent: Opt-in requirement
Sanctions
TBR - Existing statutory sanction
Regulated subjects
1
personal data (all forms): data processing
Regulatory tool
User right to rectification of personal data
User right to deletion of personal data
User right to withdraw consent
Preventive security requirement
Regulator notification requirement
User consent: Opt-in requirement
Sanctions
TBR - Existing statutory sanction
Regulated subjects
1
personal data (all forms): data collection
Regulatory tool
User right to rectification of personal data
User right to deletion of personal data
User right to withdraw consent
Preventive security requirement
Regulator notification requirement
User consent: Opt-in requirement
Sanctions
TBR - Existing statutory sanction
Regulated subjects
1

Policy change by business practice

The detailed activities within the scope of this policy or regulatory change.

personal data: biometric: data collection

personal data (all forms): storage (any form)

personal data (all forms): data processing

personal data (all forms): data collection