China Introduces a Standard Contract for Cross-Border Transfer of Personal Information

Summary 

---

|

• Entering into a standard contract with overseas recipients is one way to transfer personal information out of China
• Until now, there has been no template standard contract or detailed guidance on such standard contract
• Newly issued regulations clarify the scope of the standard contract, the extent to which the text of the standard contract must be adopted, the need for a prior personal information protection impact assessment to be conducted, and filing requirements
• The standard contract is relatively short but contains a number of key clauses which should be carefully examined, including obligations imposed on the overseas recipient and rules on governing law and jurisdiction

On June 30,2022, China's cyber watchdog, the Cyberspace Administration of China (CAC), published the Provisions on Standard Contracts for Overseas Transfer of Personal Information (Draft for Comments) (the Provisions) (个人信息出境标准合同规定（征求意见稿）, together with a template of the Standard Contract for Overseas Transfer of Personal Information (the Standard Contract) (个人信息出境标准合同) for public comment.

Entering into a standard contract with overseas recipients is one permitted way to transfer personal information (PI) out of China (which, for the purpose of this article, excludes Hong Kong, Macao and Taiwan) under Article 38 of the Personal Information Protection Law (PIPL) (个人信息保护法). The Provisions are intended to provide clear guidance on the applicable scope of such mechanism and other detailed requirements (including a template Standard Contract). These clarifications have been long awaited by stakeholders since the promulgation of the PIPL.