China’s Cross-Border Data Transfer Regime For Overseas Businesses: Explained

Transfer of Personal Data

For non-CIIO, transferring personal data outside China is an incredibly laborious process. Several layers of requirements need to be met, in addition to several assessments that need to be carried out concurrently.

However, if followed diligently, there’s no reason why each of these requirements cannot be honored, allowing for seamlessly transferring personal data outside China. Here’s how the process works.

1. Pre-Transfer Requirements:

The PIPL is reasonably transparent about setting certain pre-transfer requirements that must be met if a business operator wants to comply with China’s strict cross-border data transfer regime. These pre-transfer requirements include the following:

• Separate, informed, and explicit consent of the individual whose personal information is being transferred should be obtained,
• Organizations are required to carry out a Personal Information Protection Impact Assessment before they can initiate the process of transferring personal data out of China. This should include legitimacy, the necessity of the purpose, scope, impact on individuals’ rights and interests, security risks, and security measures,
• The transfer must be necessitated by a business or other need, or it must be made under an international treaty or agreement which has provisions requiring the transfer of data from China, and
• The users whose personal data is to be transferred are adequately informed about the potential transfer with information regarding the name of the overseas recipient, contact information, purpose and method of processing, type of personal information, and how they can exercise their data rights against the recipient.

2. Transfer Mechanisms

Once the aforementioned pre-transfer requirements are fulfilled, personal data transfer can occur. However, there are some strict protection standards set by the PIPL that the overseas recipient of data must fulfill. Typically there are three data transfer mechanisms such as security assessment, security certification, and Standard Contractual Clauses (SCCs). These are discussed in detail below:

a. Security Assessment Mechanism

As per PIPL, there are already strict data localization requirements placed on organizations. In July 2022, the Cyberspace Administration of China (CAC) passed “Measures for Security Assessment of Data Exports (“Assessment Measures”) (Effective from 1st September 2022) that discussed the need for organizations to do thorough security assessments before transferring sensitive data and individual personal information outside China.

One of the export criteria set out in these Assessment Measures was that an organization that processes the personal data of more than 1 million individuals needs to conduct a security assessment and must locally store personal information collected and generated within China. A security assessment for the cross-border transfer of personal information will also be required if:

• The organization has cumulatively transferred the personal information of more than 100,000 individuals or has cumulatively transferred sensitive personal information of more than 10,000 individuals since January 1st, 2021.

To understand the criteria and procedure for submitting a data export security assessment, please see our detailed blog on Assessment Measures.

b. Certification Mechanisms

Organizations that do not qualify for security assessments can apply to a competent government agency for third-party certification. Companies that receive the accreditation are permitted to transfer data outside of China. Certification Guidelines establish standardized cross-border processing mechanisms and also provide a certification system for personal information protection.

The Certification Guidelines have a broad scope as they are applicable on:

1. If the data transfer is within a multinational company or among subsidiaries or affiliates of the same economic or public entity;
2. The organization’s data processing activities are subject to the PIPL’s extraterritorial jurisdiction.

In the case of cross-border transfers within a multinational company, the domestic party may apply for certification and assume legal responsibility for such transfers. However, in the case of extraterritorial applicability of PIPL, foreign organizations can apply for the certifications through their locally established entity or designated representative. As for unrelated entities, they’ll need to rely on the standard contract mechanism.

Organizations that carry these certifications can proceed seamlessly with their data transfer activities.

c. Standard Contractual Clauses (SCCs) Mechanism

Organizations can also seamlessly transfer data out of China by adopting any of the SCCs stipulated by the CAC. To give guidance on the implementation of Article 38(1)(3) of PIPL, Draft Provisions on Standard Contracts for the Export of Personal Information (Draft Provisions) were issued. The Draft Provisions provide the following instances where organizations may rely on SCCs for cross-border data transfers:

• The organization is a non-CIIO,
• The organization processes the personal data of less than 1 million users,
• The organization has cumulatively transferred the personal information of fewer than 100,000 individuals or the cumulatively transferred sensitive personal information of fewer than 10,000 users since January 1st, 2021.

If the organization exceeds the above-mentioned threshold, it must use the security assessment mechanism for any cross-border data transfer.

In addition, Article 6 of the Draft Provisions lays down the main contents that should be included in the standard contract for data transfers. The requirements for this are the same as DPIAs with the addition of ​​quantity, method, storage period, storage location, etc., of where personal information goes abroad.

d. Other Laws and Mechanisms Approved by CAC

Where an organization satisfies other conditions prescribed by other Chinese laws, administrative regulations, or the CAC, it may transfer personal information. Furthermore, organizations that do not need to undergo a security assessment may also rely on an international treaty or agreement that China has signed as the basis for the data transfer.

Transfer of Important Data

Both the CSL and DSL require organizations to carry out a mandatory security assessment regarding cross-border transfers of important data.

Organizations must have mechanisms and checks in place to promptly identify important data. The Security Assessment Measures have an unambiguous definition for important data as being “data that, once tampered with, destroyed, leaked, illegally obtained or illegally used, may endanger national security, economic operation, social stability, public health and safety, and so forth.”

The Draft Guidelines for the Identification of Important Data state that any data that contains the following can be deemed important data:

• Operation of Economy,
• Population and Health,
• Natural Resources and Environment,
• Science and Technology,
• Security Protection,
• Service Providing,
• Government Affairs, and
• Other non-state secret information.

How Can Securiti Help

An increasing number of countries have begun to, have drafted, or have already enforced data privacy laws. The primary purpose behind most of these is to ensure the safety and privacy of users’ data by placing certain obligations and responsibilities upon organizations that collect and process the users’ data.

In most cases, these obligations extend to cross-border data transfers to guarantee the same level of security is extended to users’ data if it is transferred outside the country or region where it was collected.

Securiti is a market leader in providing enterprise solutions in data governance and compliance. Its state-of-the-art artificial intelligence and machine learning algorithms enable automated compliance with all major data regulations based on its plethora of privacy products such as DSR automation, data classification, cookie consent management, and breach management, among others.

Request a DEMO today and learn more about how Securiti can help your organization comply with the PIPL, DSL, CSL, and all other global data regulations.