Support Centre

China

Summary

Law: Personal Information Protection Law ('PIPL') (Enforcement date of 1 November 2021)

Regulator: The Cyberspace Administration of China ('the CAC').

Summary: On 20 August 2021 China approved the PIPL, the first comprehensive data protection legislation in the region. The Law entered into effect on 1 November 2021 and established personal information processing rules, data subject rights, and obligations for personal information processors, among other things. In addition to the PIPL, the NPC has also approved, on 10 June 2021, the Data Security Law, which entered into effect on 1 September 2021. The Data Security Law regulates data processing activities associated with personal and non-personal data.

There are also provisions related to personal data protection in several other pieces of legislation; most notably the Cybersecurity Law 2016 which came into effect in 2017 (official Chinese version available here; unofficial English available here) ('the Cybersecurity Law') which provides certain general requirements, and the regulations for the protection of children's personal information (only available in Chinese here) which contains obligations relating to the processing of children's personal data stipulated. In addition, there are numerous non-binding guidelines and standards, which provide best practice recommendations for the handling of personal data. The most notable of these is Standard GB/T 35273-2020 on Information Security Technology - Personal Information Security Specification.

Insights

On 24 February 2023, the Cyberspace Administration of China ('CAC') promulgated the finalised Standard Contract Measures for Exporting Personal Information1 ('the Measures'), along with the Personal Information Export Standard Contract ('the Standard Contract'). The Measures will take effect on 1 June 2023. Most companies which transfer personal information out of China will need to adopt responsive measures in order to comply.

In this Insight article, Richard Qiang, Partner at DaHui Lawyers, provides a summary of the key takeaways from the Measures and the Standard Contract.

On 2 December 2022, the Communist Party of China ('CPC') Central Committee and the State Council jointly released the Opinions on Building Basic Systems for Data to Better Play the Role of Data Factors ('the Opinions'), in order to speed up efforts to build basic systems for data, give full play to China's strengths in massive-scale data and rich application scenarios, and stimulate the potential of data factors. Dr. Annie Xue and Yang Chen, from GEN Law Firm, outline the key takeaways from the Opinions.

On 24 February 2023, the Cyberspace Administration of China ('CAC') released the final form of its key transfer mechanism for data exports - the long-awaited Personal Information Export Standard Contract ('the Standard Contract') and its accompanying Measures on the Standard Contract ('the Measures'), which set out the principles governing the use of the Standard Contract. While the Standard Contract comprises one of three transfer mechanisms under China's data protection law - the Personal Information Protection Law of the People's Republic of China ('PIPL') - the Standard Contract is anticipated to be the most popular approach for international businesses seeking to export personal information out of mainland China.

Alex Roberts, from Linklaters, and Roger Li and Tiantian Ke, from Zhao Sheng Law Firm, look at the key aspects of the Standard Contract and compare them to the EU 2021 Standard Contractual Clauses ('EU SCCs').

Great news from the Cyberspace Administration of China ('CAC') - China's Standard Contract Measures for Exporting Personal Information ('the SCC Measures') have been officially adopted by the CAC on 22 February 2023. Since this date, there officially are three approaches for data transfers under the Personal Information Protection Law ('PIPL') of the People's Republic of China ('PRC'). Without a doubt, the Chinese Standard Contractual Clauses ('SCCs') will be a great choice for small and medium-sized organisations to comply with the requirements for data transfers.

Dehao Zhang, Counsel at Fieldfisher China, discusses the SCC Measures, including requirements around Personal Information Protection Impact Assessments ('PIPIAs') and practical considerations for businesses.

Critical Information Infrastructure Operators ('CIIOs') are extremely important to China's cybersecurity and national security under Chinese laws and regulations. In this Insight article, Dehao Zhang, Counsel at Fieldfisher China, dives into the definition and legal obligations of CIIOs.

The long-awaited Standard Contractual Clauses of China ('China SCCs'), as referred to in Article 38 of the Personal Information Protection Law ('PIPL'), and the Regulations for the China SCCs ('the Regulations') were finally endorsed and released by the Cyberspace Administration of China ('CAC') on 24 February 20231.

The perception of the China SCCs as being straight-forward and simple template clauses to just be concluded as they are could lead in the wrong direction. The complexities ahead shall not be underestimated, particularly for multinational companies. In this Insight, Dr. Michael Tan, Dr. Paul Voigt, Julian Sun, and Wiebke Reuter, from Taylor Wessing, share their long-term observations and thoughts on the China SCCs, as well as practical steps on how businesses can prepare.

On 24 February 2023, the Cyberspace Administration of China ('CAC') promulgated the Standard Contractual Measures for the Export of Personal Information ('the Measures'), which come into force on 1 June 2023 ('the Effective Date'), and to which the Personal Information Exit Standard Contract ('SCCs') was annexed.

In this Insight article, Samuel Yang, Chris Fung, and Monika Zhang, from AnJie Broad Law Firm, provide a high-level introduction to the content of the SCCs.

The State Administration for Market Regulation ('SAMR') and the Cyberspace Administration of China ('CAC') have jointly formulated and released the Rules for the Implementation of Personal Information Protection Certification. In fact, they decided to implement a personal information protection certification according to the Regulations of the People's Republic of China on Certification and Accreditation, with a view to encouraging personal information processors to improve their personal information protection capabilities through certification.

Dehao Zhang, Counsel at Fieldfisher LLP, unpacks the key elements of the certification, which, despite not being a mandatory obligation for organisation, provides another compliance approach for cross-border data transfers.

On 24 February 2023, the Cyberspace Administration of China ('CAC') released the Standard Contract Provisions for the Export of Personal Information ('the Standard Contract Provisions'). The Standard Contract Provisions are intended to implement Article 38(1)(3) of the Personal Information Protection Law ('PIPL') and provide for one of the lawful methods for the transfer of personal information outside of China. The Standard Contract Provisions contain a standard contract akin to Standard Contractual Clauses ('SCCs') and establish requirements for personal information processors, as well as overseas recipients, notably the obligation to carry out Data Protection Impact Assessments ('DPIAs'). OneTrust DataGuidance Research breaks down the Standard Contract Provisions.

On 16 December 2022, the National Information Security Standardization Technical Committee of China promulgated the guidelines for the Cybersecurity Standards Specification for the Certification of Cross-Border Processing of Personal Information v2.0 ('the revised Specification'), replacing the original specification enacted on 26 June 2022. The revised Specification provides implementation rules for one of the practical ways for lawfully conducting cross-border data processing activities, i.e. third-party certification. The revised Specification contains the applicable scenarios, ways to obtain certification, basic principles, basic requirements, and special requirements for securing data subjects' rights. Ziqing Zheng, Partner at Zhong Lun Law Firm, discusses the revised Specification and its content.

Part one of this series presents an overview of the Information Security Technology - Technical Requirements of Security Design for Cybersecurity Classification Protection (GB/T 25070-2019) ('the Security Design Requirements') and Part two of this series looks at the Information Security Technology - Implementation Guide for Classified Protection of Cybersecurity (GB/T 25058-2019) ('the 2019 Implementation Guide'). In this article, Todd Liao, Partner at Morgan, Lewis & Bockius LLP, provides an overview of MLPS 2.0, highlights key requirements under MLPS 2.0 and the Information Security Technology - Evaluation Requirements for Cybersecurity Classification Protection (GB/T 28448-2019) ('the Evaluation Requirements') in particular, and proposes recommendations for network operators in China.

On 16 December 2022, the National Information Security Standardisation Technical Committee of China ('TC260') released a revised version of the Practice Guidelines for Cybersecurity Standards - Technical Specification for the Certification of Cross-Border Processing of Personal Information ('the revised Certification Specification')1, less than six months after issuing the first version of the Certification Specification2.

In this article, James Gong, Partner at Bird & Bird, highlights the key provisions of the revised Certification Specification, with concluding thoughts on the impact of the same, especially in comparison to the draft Personal Information Export Standard Contract ('the draft Standard Contract')3.