The People’s Republic of China (PRC) has built up its legal regime concerning outbound data transfers in accordance with the Cybersecurity Law of the PRC, the Data Security Law of the PRC   and the Personal Information Protection Law of the PRC (PIPL). This legal regime not only imposes restrictions on outbound transfers of personal information but also on what is defined as “important data,” subject to the data classification provided in the Cybersecurity Law and the Data Security Law. In practice, the scope of personal information can overlap with the definition of important data. Here, however, we focus simply on how to provide personal information abroad from the PRC, in particular, on the essential procedures involved.

Obtaining the data subject’s consent

First, Article 39 of the PIPL sets out that if a personal information handler needs to provide personal information of PRC residents to an overseas recipient, the handler must first i) provide to the data subjects information about the recipient, such as its name, contact information, purposes and methods of the processing, the data categories and the methods and procedures for the data subjects to exercise their rights, and ii) obtain the individual’s separate consent on the data cross-border issue. Therefore, it is often the case that the first step in making an outbound data transfer is to obtain the subject’s consent through notification. And conducting a personal information protection impact assessment (PIA) is also a legal precondition in line with Article 55 of the PIPL.

Necessary conditions to fulfill for transferring data abroad

More importantly, Article 38 of the PIPL provides that if a handler wants to transmit or share personal information outside China, it must fulfill at least one of the following conditions. (The conditions to be fulfilled depend, among other things, on the classification of the data handler and the amount and type of information to be transferred):

1. Passing the security assessment organized by the Cyberspace Administration of China (CAC);
2. Obtaining a certification on personal information protection from a specialized institution, in accordance with the provisions issued by the CAC;
3. Signing an agreement with the overseas recipient in line with the standard contract prepared by the CAC;
4. Meeting other conditions prescribed by laws, administrative regulations or the CAC.

Data handlers that must pass a CAC security assessment

Article 40 of the PIPL identifies two types of subjects that must pass a security assessment organized by the CAC:

1. Critical information infrastructure operators

Article 2 of the Security Protection Regulations for Critical Information Infrastructure defines “critical information infrastructure” as network facilities and information systems in important industries and sectors, such as public telecommunications and information services, energy, transportation, water conservancy, finance, public services, e-government, industries of science and technology for national defense as well network facilities and information systems that, if damaged, suffered a loss of functionality or a data leak, would seriously endanger national security, the domestic economy, people’s livelihoods and the public interest.

2. Data processors that handle personal information in an amount prescribed by the CAC

According to Article 4 of the Security Assessment Measures for Outbound Data Transfers, this applies to handlers that process the personal information of more than 1 million individuals or that has provided abroad the personal information of 100,000 individuals or the sensitive personal information of 10,000 individuals since January 1 of the previous year.

Certification option

The National Information Security Standardization Technical Committee issued the Cybersecurity Standard Practice Guide for Security Certification of Cross-border Data Processing in June 2022, which lists the basic principles and requirements for completing such certification.

Standard contract option

The CAC in June 2022 released the Provisions on Standard Contracts for Cross-border Transfers of Personal Information (Draft) for public comment. These provisions are similar to the EU’s Standard Contractual Clauses, which specify the rights and obligations of handlers and their recipients abroad. We stress that these provisions are still in a draft version, so the standard contract included may vary in some ways in its final version.

Conclusion

Data handlers in the PRC that are not required, in accordance with Article 40 of the PIPL, to undergo a compulsory security evaluation have three options for legally providing personal information to data recipients outside China in compliance with the existing legal regime: They may obtain a personal information protection certification, enter into an agreement with the recipients involved in line with the standard contract, or they still undergo a CAC security assessment.