A new level in China's efforts to regulate cyberspace. China's National People's Congress (NPC) on Friday passed a law to protect users' online privacy, which will take effect from November 1.

According to the China News Agency, the law stipulates that the processing of personal information must be limited to the "minimum extent necessary" to achieve a clear and reasonable purpose. It also sets out the conditions under which companies in the country can collect personal data and the procedure for ensuring the protection of data that is transferred outside China. The regulation also requires that personal information handlers appoint a person in charge of data protection and calls for them to conduct periodic audits. The Data Security Law, to be implemented on September 1, will allow companies to classify data according to its economic value and relevance to China's national security. The Personal Information Protection Law, meanwhile, aims to ensure user privacy, modeled on the European General Regulation (RGPD). Both will require Chinese companies to review their data storage and processing practices to ensure compliance, experts say.