Important concepts in cross-border transfer of data from China

Key considerations for companies is to consider whether they are a critical information infrastructure operator (“CIIO”), whether they hold “personal data”, “important data” and/or “national core data”. These are vital concepts in understanding cross-border data transfer rules in mainland China. The rules are still in developmental stages, and industry specific guidelines are expected.

Personal data

For companies storing personal information within mainland China, the rules on cross-border transfer under the PIPL must be followed. Personal information, similar to GDPR, is defined as all kinds of information related to identified or identifiable natural persons that are electronically or otherwise recorded. The definition of sensitive personal information is slightly wider than GDPR as it also includes financial account information and location tracking information.

Personal data processors whether in mainland China or abroad wishing to transfer personal data outside of mainland China must, among other things:

• obtain a separate consent from the relevant individual;
• meet one of the following conditions:
  • passing a security assessment conducted by the Cyberspace Administration of China (“CAC”);
  • obtaining personal information protection certification issued by a CAC-accredited institution;
  • entering into standard contracts issued by the CAC; or
  • other conditions as specified in the mainland laws and regulations;

• conduct personal information protection impact assessment in advance; and
• ensure that personal information processing activities of the overseas recipient meet the personal information protection standards under PIPL.

The above requirements are further elaborated in the draft “Regulations on Administration of Network Data Security” published by the CAC.

CIIOs and the personal information processors that process the personal information reaching the threshold specified by the CAC in terms of quantity are required to store personal information collected and generated within mainland China domestically, and shall further pass a security assessment to assess whether it is truly necessary to provide the information to an overseas recipient.

Processors must not provide personal information stored in mainland China to foreign judicial or law enforcement authorities, unless otherwise approved by the Chinese regulatory authority in accordance with the applicable Chinese law, the international conventions or bilateral treaties signed by China, or on reciprocal basis. So what do companies need to consider?

Are you a Critical information infrastructure operator?

CIIOs are subject to more stringent requirements, both in terms of storing certain data within mainland China and cross-border data transfer. According to the “Regulation on Protecting the Security of Critical Information Infrastructure” issued by the State Council in 2021, “critical information infrastructure” means any network facilities and information systems in important industries and fields (such as public communication and information services, energy, transportation, water conservancy, finance, public services, e-government, and science, technology and industry for national defence) that may seriously endanger national security, national economy and people's livelihood, and public interests in the event that they are damaged or lose their functions or their data are leaked.

Do you have Important data?

There are requirements as to how important data should be handled, but important data itself is not defined clearly under DSL or CSL. Article 21 of DSL states that each region or department shall, under the coordination of the national data security work coordination mechanism determine the specific catalogs of important data in the region or department and in the relevant industries and fields.

In January this year, the National Information Security Standardization Technical Committee published the draft “Information security technology - Identification guide of key data”, which provides more guidance on how to identify important data. In the draft guide, important data is defined as data that exists in electronic form and might endanger national security and public interest if being subject to tampering, destruction, or divulgence or illegal acquisition or utilization.

Article 31 of the DSL sets out the rules in relation to cross-border transfers of important data, applicable to CIIOs and other data processors. For CIIOs, the CSL applies; for other data processors, the rules developed by the national cyberspace authority in conjunction with the relevant departments of the State Council apply. Under Article 37 of CSL, CIIO may transfer important data abroad on the successful completion of a security assessment and compliance with other requirements of laws and regulations.

Do you have National core data?

National core data is defined under Article 21 of DSL as data that matters to national security, the lifeline of national economy, important aspects of people's livelihood, or material public interest, among others. Such data is subject to a more stringent management system. More guidance from the relevant departments is expected.

It is important for companies to prepare themselves for compliance with the relevant rules by conducting their data mapping exercise, in particular, by identifying what kind of personal data, important data and national core data they possess and where it can be accessed.

Article provided by INPLP member: Jennifer Wu (Pinsent Masons LLP, HongKong)

Discover more about the INPLP and the INPLP-Members

Dr. Tobias Höllwarth (Managing Director INPLP)