Businesses Navigating Data Transfer Uncertainties by Balancing Compliance Necessity, Business Costs

China's newly released draft PRC Personal Information Protection Law (PIPL) (中华人民共和国网络安全法) introduces two new mechanisms for transferring personal information overseas, taking elements of the European Union's General Data Protection Regulation (GDPR) to potentially reduce direct government involvement in the regulatory regime (read part one of our analysis here).

Companies in China have welcomed this development, but uncertainty remains surrounding the scope of the regulatory regime once it is finalized. In particular, the questions of what types of companies will be subject to security assessments should they seek to transfer personal information overseas, as well as what kinds of data transfer will be subject to scrutiny, remain unanswered. Given these lingering uncertainties, companies in China have mostly adopted a data processing strategy of localizing where possible while exporting where necessary.