In June 2018, Samm Sacks, a senior fellow in the technology policy programme at the think tank CSIS, told the Cloudflare Internet Summit in London that China had a new data protection standard. She said it was written with the EU’s General Data Protection Regulation (GDPR) in mind, and in some respects went further. Her talk came weeks after GDPR took effect on 25 May 2018.
The Chinese measure she described was a national standard, not a statute. Law firm Hogan Lovells records that the Standardization Administration of China and the quality supervision authority issued the Personal Information Security Specification (GB/T 35273-2017) on 29 December 2017. It came into effect on 1 May 2018, which is the “May” in the headline most readers remember.
The context: two tracks in Chinese internet policy
Sacks began by rejecting a simple picture of China’s internet. In her telling there were two parallel tracks. One was the world’s most extensive censorship system. The other was a digital economy among the most advanced anywhere.
Strict privacy rules could look contradictory next to that. Sacks’s explanation was that the two tracks answered different questions: what companies may do with data, and what the state may do. In her view, Beijing had concluded that its ability to monitor and control new technologies was lagging. It had therefore built what she called one of the most comprehensive legal systems for cyberspace in the world. It covered digital content, what the government called critical information infrastructure, and limits on data moving in and out of the country.
She dated the effort to 2014, when Xi Jinping took over the Central Leading Group for Cyberspace Affairs. The Cybersecurity Law followed in June 2017, covering infrastructure and data governance.
Sacks’s argument: privacy awareness, and a GDPR model
Sacks also challenged the idea that Chinese users did not care about privacy. She pointed to public outcry on Chinese social media over private companies mining personal data and selling it on the black market. The standard, she said, was a response to those scandals. It set out detailed rules on consent and on when companies could collect, process, store, share or transfer personal data.
She said she had spoken with the lead drafter. He told her the standard was modelled on GDPR, with the aim of giving Chinese users more control over their information.
GDPR also had effects inside China. Sacks said some Chinese companies were alarmed by it. On the eve of the deadline, she said, firms were scrambling to work out their obligations. One company, she recalled, asked whether it now had to get consent from every user on its privacy policy. Those companies were also expanding into Europe, and she doubted whether full compliance was even possible.
The “dance” with Beijing
The second theme was how Chinese tech giants balanced state backing against global ambition. Alibaba Cloud’s EMEA general manager, Yeming Wang, had described plans to expand in Europe and compete with Google Cloud Platform and AWS. He cited 360,000 transactions per second on Singles Day and more than 500 million users on Ant Financial’s app. Alipay said that week that it would enter 20 more European markets in 2018.
Sacks said Alibaba and Tencent faced a difficult task abroad. Their success, she argued, depended on state support at home, yet they were private companies funded by private investors. Xi had used an April 2018 speech to call for big, strong Chinese internet firms. She noted he had earlier named Alibaba, Tencent and Huawei. She quoted Jack Ma’s line that loving someone does not mean you should marry them.
Her sharpest point concerned data. Strict cybersecurity rules on cross-border transfers would hit Alibaba first, she said. She asked how it could expand in Europe and Asia if data could not leave China.
A competing model for the internet
Sacks said China was offering the first real alternative model of how to govern the internet. She cited Vietnam, which had recently codified a cybersecurity law resembling China’s. She also cited Tanzania, which had worked with Chinese cyber officials on approaches ranging from censorship tools to data localisation and standards.
She saw an innate appeal for countries worried about the internet being used against their own citizens, such as through hate speech. She cited the use of social media to incite violence in Myanmar. She said she did not see a master plan to confront the Western-led model. Some countries adopted these tools on their own, she said, while others, like Tanzania, were influenced more directly.
How it held up
The standard Sacks described was voluntary and was later revised as GB/T 35273-2020. The binding law came later. China’s Personal Information Protection Law (PIPL) was passed by the National People’s Congress Standing Committee on 20 August 2021 and took effect on 1 November 2021. DataGuidance describes it as China’s first comprehensive data protection law and notes broad similarities with GDPR.
Legal 500’s 2026 guide puts the PIPL alongside the Cybersecurity Law and the Data Security Law as the foundation of China’s data regime. It calls the PIPL broadly similar to GDPR in its core principles. A 2025 paper in Nature’s Humanities and Social Sciences Communications cites scholars who argue that GDPR gave Chinese lawmakers a model to follow.
Differences remain. Captain Compliance notes that the PIPL requires certain personal information collected in China to be stored there unless an exemption applies, whereas GDPR has no explicit localisation rule. That echoes the cross-border tension Sacks raised in 2018.