Secretariat of the National Information Security Standardization Technical Committee, Cybersecurity Standard Practice Guidelines: Specifications for the Security Certification of Cross-Border Personal Information Processing Activities V2.0 (Draft for Comments)

Issued: November 8, 2022

Main contents: Both the personal information processor and the foreign (here and hereafter, meaning outside of mainland China) recipient shall undertake to bear legal liability for the infringement of rights and interests in personal information, and where the legal liability is not clear cut, it is borne by the personal information processor (Article 5.1(j)).

Both a personal information processor that engages in cross-border personal information processing activities and the foreign recipient shall conduct regular compliance audits of the compliance of its processing of personal information with the laws and administrative regulations of the People's Republic of China and submit to monitoring of its cross-border personal information processing activities by the certification institution, including responding to questions and cooperating in inspections (Article 5.2.2(e)).