China Finalizes Provisions On Cross-Border Data Transfer

JD
Jones Day

Contributor

Jones Day is a global law firm with more than 2,500 lawyers across five continents. The Firm is distinguished by a singular tradition of client service; the mutual commitment to, and the seamless collaboration of, a true partnership; formidable legal talent across multiple disciplines and jurisdictions; and shared professional values that focus on client needs.
Chinese authorities issued new regulations and guidance governing cross-border transfers of data and personal information, which will significantly reduce procedural and compliance burdens for many multinationals.
China International Law
To print this article, all you need is to be registered or login on Mondaq.com.

Chinese authorities issued new regulations and guidance governing cross-border transfers of data and personal information, which will significantly reduce procedural and compliance burdens for many multinationals.

On March 22, 2024, the Cyberspace Administration of China issued the Provisions for the Promotion and Standardization of Cross-Border Data Flows (the "Provisions") and updated guidelines for security assessments and standard contracts (collectively, the "Guidelines"), all effective immediately.

The Provisions and the Guidelines clarify and relax requirements relating to cross-border data transfers.

Exemptions From Additional Procedural Requirements for Cross-Border Data Transfers

Previously, data handlers were required to pass an assessment, file a standard contract with authorities, or undergo personal information ("PI") protection certification if they transferred any PI abroad. Under the Provisions, a data handler is exempt from such requirements in these scenarios:

  • Re-export of PI imported from outside China, as long as the data handler does not introduce PI or "important data" from China during processing;
  • PI transfers for entering into or performing contracts with individuals;
  • Employee PI transfers for human resources management;
  • PI transfers to protect life and property in emergencies;
  • Non-sensitive PI transfers by handlers that are not critical information infrastructure operators ("CIIOs") of less than 100,000 persons in the current year;
  • Transfers of data not listed in a free trade pilot zone's Negative List by a registered handler; and
  • Data generated from international trade, cross-border transportation, academic cooperation, transnational manufacturing, and marketing, if the data does not contain PI or "important data" (data is not "important data" unless notified by relevant authorities or publicly released as "important data").

When Additional Procedural Requirements Apply

Subject to exemptions, assessments are mandatory when: (i) CIIOs transfer PI or "important data"; or (ii) non-CIIOs transfer "important data" or PI (in the current year) of more than 1 million persons or transfer sensitive PI of more than 10,000 persons.

Subject to exemptions, Standard Contracts or Certifications are required when non-CIIOs: (i) transfer PI (in the current year) of more than 100,000 and less than 1 million persons; or (ii) transfer sensitive PI of less than 10,000 persons.

Next Steps

Because the Provisions and the Guidelines significantly ease compliance burdens, companies should evaluate their cross-border transfers to determine what requirements they are required to meet going forward.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

China Finalizes Provisions On Cross-Border Data Transfer

China International Law

Contributor

Jones Day is a global law firm with more than 2,500 lawyers across five continents. The Firm is distinguished by a singular tradition of client service; the mutual commitment to, and the seamless collaboration of, a true partnership; formidable legal talent across multiple disciplines and jurisdictions; and shared professional values that focus on client needs.
See More Popular Content From

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More