China's National People's Congress passed a law, the Personal Information Protection, which protects online user privacy in cyberspace. As the second draft of the law was lodged in April, upon passing, it will be implemented starting November 1. 

With China's ever-growing industrial sector, the law adds to national security regulations to modulate cyberspace, which poses more requirements and obligations for companies and corporations in the country. 

The law has a number of clauses: when handling personal data, there is to be minimal intervention in handling the data; according to Xinhua news agency, handling personal information must have a purpose such that when it is handled, it is limited to "minimum scope necessary to achieve the goals of handling" data. 

In addition to having a purpose, the law lays out conditions under which companies can collect personal data: for example, there must be an obtained consent, while also laying out guidelines to make sure that data is protected when transferred outside the country.

The law essentially restricts companies from collecting excessive information.

Furthermore, the law also requires those handling personal information to appoint an individual in charge of protecting personal information, as well as necessitating that handlers conduct periodic inspections to ensure compliance with the new law.

The new law aims to cater to those "who feel strongly about personal data being used for user profiling and by recommendation algorithms or the use of big data in setting [unfair] prices," a spokesman for the National People's Congress told state news agency Xinhua earlier this week.

The Personal Information Protection law, along with the Data Security Law, are the two most recent milestones in regulating cyberspace in China. The Data Security Law requires companies to classify data based on economic value and proximity to China's national security. 

The Data Security Law is to be implemented on September 1.