The Information Security Technology—Personal Information Security Specification (GB/T 35273-2020) entered into force on 1 Oct. 2020. Since then the Information Security Technology—Personal Information Security Specification (GB/T 35273-2017) had been replaced.

This Specification aims to regulate the relevant behaviors of the personal information controller in the collection, storage, use, sharing, transfer, public disclosure and other information processing links, so as to curb the illegal collection, abuse, leakage, etc. of personal information.

This Specification is not a compulsory regulation, but more of a recommended standard the government encourages enterprises to adopt voluntarily.