China Expects to Loosen Restrictions on Cross-Border Data Transfer

Summary

---

• Regulating the cross-border flow of data has always been a priority for Chinese regulators, particularly where personal data or potentially sensitive or secret information is concerned
• A new set of draft provisions has been published which aim to regulate, and also facilitate, such flows
• Companies should familiarize themselves with the provisions and examine their processes, particularly how much data they transfer annually
• Although compliance burdens will increase in some areas, in others there will be significant simplification

On Sept. 28, 2023, just before the start of an 8-day public national holiday, the Cyberspace Administration of China (CAC) published a draft document titled the Provisions for Regulating and Promoting the Cross-Border Flow of Data (Draft for Comments) (规范和促进数据跨境流动规定（征求意见稿）), "Draft Provisions") for public feedback. 

The release of this draft document indicates that the CAC and other data security regulators in China recognize the regulatory challenges posed by the current regime on cross-border data transfer and the difficulties faced by data/personal information handlers. The CAC aims to relax the restrictions on cross-border data transfer without altering the existing regulatory framework established by the PRC Cybersecurity law, PRC Data Security Law, and PRC Personal Information Protection Law. It aims to facilitate and promote the orderly flow of data in daily business operations that do not impact national security. The 14th measure of the State Council, Opinions on Further Improving the Foreign Investment Environment and Enhancing Foreign Investment Attraction (国务院关于进一步优化外商投资环境加大吸引外商投资力度的意见) issued by the State Council in August 2023, also reflects this intention. The Draft Provisions can therefore be seen as a document issued in order to implement the requirements stated in the State Council's Opinions.