Cross-Border Transfers of Personal Information Out of China

Summary 

---

|

• The cross-border transfer of personal information (PI) has been one of the regulatory focuses of the Chinese authorities
• There are a number of ambiguities, including whether the cross-border transfer of small amounts of PI by certain PI handlers will be subject to security assessments by CAC
• Many companies will need to conduct cross-border transfers of PI in their day-to-day business
• There are a number of steps which can be taken by multinational companies now to continue cross-border transfer of PI while ensuring the transfer is compliant with current rules and is ready to comply with imminent ones

Unfortunately, although it has been more than seven months since the PIPL came into effect, the specific rules regarding the cross-border transfer of PI have still not been finalized

The cross-border transfer of personal information (PI) has been one of the regulatory focuses of Chinese authorities on the subject of protection of personal information. Since the PRC Cybersecurity Law (CSL) (中华人民共和国网络安全法) came into effect in 2017, more and more restrictions have gradually been placed on the cross-border transfer of personal information from mainland China. Among various relevant laws and regulations Articles 38 to 40 of the PRC Personal Information Protection Law (PIPL) (中华人民共和国个人信息保护法), which became effective on Nov. 1, 2021, are deemed as setting out the basic principles for cross-border transfer of PI. However, these statutory provisions only stipulate the basic conditions to be met for cross-border transfer of PI, including security assessment requirements under certain scenarios. In practice, how PI can legally be transferred out of mainland China still depends on the implementation regulations and guidance set by authorities such as the Cyberspace Administration of China (the CAC). Unfortunately, although it has been more than seven months since the PIPL came into effect, the specific rules regarding the cross-border transfer of PI have still not been finalized. This has caused some operational confusion among those doing business in mainland China, in particular multinational companies.

1 .   Requirements for Cross-Border Transfer of PI under PIPL and the Latest Draft Regulations