China has passed a user data privacy lawIllustration by Alex Castro / The Verge

China has passed a new privacy law aimed at protecting users’ personal data, state media reported. The new law comes as Chinese tech firms have come under renewed scrutiny in the country, and sets rules around how companies handle users’ information. The law takes effect on November 1st.

The law—formally called the Personal Information Protection Law— was passed by China’s legislature on Friday, Reuters reported, and calls for companies to get users’ consent before collecting personal data, and has rules for how companies should ensure users’ data is protected when it’s transferred outside of China. Tech companies that handle personal information must have a designated person tasked with overseeing its protection, and companies must conduct regular audits to be sure they’re complying with the law.

In addition, companies handling personal user data have to have clear and reasonable purpose for doing so, and must limit it to the “minimum scope necessary to achieve the goals” of handling said data, according to Reuters.

In an op-ed in the Chinese state media outlet People’s Court Daily, the National People’s Congress lauded the new legislation, Reuters reported.

“Personalization is the result of a user’s choice, and true personalized recommendations must ensure the user’s freedom to choose, without compulsion,” the op-ed piece read. “Therefore, users must be given the right to not make use of personalized recommendation functions.”