{"id":12993,"date":"2023-09-07T06:30:40","date_gmt":"2023-09-07T06:30:40","guid":{"rendered":"https:\/\/focus.cbbc.org\/?p=12993"},"modified":"2025-04-23T09:06:14","modified_gmt":"2025-04-23T09:06:14","slug":"how-to-comply-with-chinas-new-rules-for-cross-border-transfer-of-personal-information","status":"publish","type":"post","link":"https:\/\/focus.cbbc.org\/how-to-comply-with-chinas-new-rules-for-cross-border-transfer-of-personal-information\/","title":{"rendered":"How to comply with China’s new rules for cross-border transfer of personal information"},"content":{"rendered":"

Multinational corporations operating in China often share information with their subsidiaries or headquarters outside the country. However, since new regulations came into effect in June 2022, certain personal data processors, including companies that only handle data on fewer than 1 million people, are required to sign contracts with overseas recipients before sending data abroad,<\/span> writes Kristina Koehler-Coluccia<\/strong>, Head of Business Advisory<\/strong> at Woodburn Global<\/strong><\/h2>\n

The legislative framework in China for governing data security consists of three laws: the Cybersecurity Law, the Data Security Law, and the Personal Information Protection Law. The Measures on the Standard Contract for Cross-border Transfers of Personal Information, which came into effect last June, have the biggest impact on companies in China.<\/span><\/p>\n

Though the measures have been in effect for some time, their implementation has been slow in practice as there are too many such companies in China and not enough manpower to handle their assessment reports. High compliance costs, difficulties in communicating with overseas data recipients and regulatory uncertainty are some key factors affecting companies\u2019 willingness to declare cross-border data transfers.<\/span><\/p>\n

\"launchpad<\/a><\/p>\n

The new rules, aimed at protecting national security, directly impact the cross-border transfer of personal information by businesses operating in China, Chinese companies listed overseas and those in data-rich industries such as retail, internet, health care, automotive, civil aviation and finance.<\/span><\/p>\n

Corporations that regularly share employee or customer data with their headquarters, share IT infrastructure with their Chinese subsidiaries or have remote access to data stored in China may be subject to China\u2019s cross-border data transfer requirements.<\/span><\/p>\n

The first of the three mechanisms for transferring personal information out of China is the signing of a standard contract with an overseas recipient. <\/span>The other two are a mandatory security assessment by the Cyberspace Administration of China (CAC) for critical information infrastructure operators, and transfers of important\/sensitive personal data and certification by an accredited institution (applicable to intra-group transfers and data processors abroad subject to the extra-territorial application of China\u2019s Personal Information Protection Law<\/a>).<\/span><\/p>\n

The latter certification is only available if the transfer does not fall within the mandatory assessment requirements, and not all entities can adopt this option. For example, representative offices set up by foreign entities are not eligible.<\/span><\/p>\n