A new level in China's efforts to regulate cyberspace. China's National People's Congress (NPC) on Friday passed a law to protect the privacy of online users' data, which will come into effect from Nov. 1.

According to the New China News Agency, the law states that the processing of personal information must be limited to the "minimum scope necessary" to achieve a clear and reasonable purpose. It also sets out the conditions under which companies in the country can collect personal data and how to ensure the protection of data that is transferred outside of China. This regulation also requires that managers of personal information appoint a person in charge of their protection and has called on them to carry out periodic checks. The data security law, which is due to be implemented on Sept. 1, will allow companies to classify data based on its economic value and relevance to China's national security. The law on the protection of personal information aims to guarantee the confidentiality of users, on the model of the European General Regulation (GDPR). Both will require Chinese companies to review their data storage and processing practices to ensure compliance, experts say.