China’s New Measures for Cross-Border Data Transfers

China has introduced new regulations governing cross-border data transfers, setting stricter guidelines for businesses that handle and transfer personal and sensitive data across international borders, writes Kristina Koehler-Coluccia, Head of Business Advisory at Woodburn Accountants & Advisors

The new measures, which aim to protect data privacy and national security, require companies to implement comprehensive risk assessments, obtain regulatory approvals, and ensure transparency in data handling. For businesses transferring data in or out of China, understanding these requirements is crucial for maintaining compliance and avoiding penalties.

Key provisions of the cross-border data transfer regulations

1. Mandatory security assessments for sensitive data transfers
   • Companies that transfer sensitive or critical data outside China must now conduct detailed security assessments. These assessments evaluate the risks associated with data transfers and ensure that data security standards are met. Businesses must demonstrate that adequate safeguards are in place to protect sensitive information during cross-border transfers.
2. Regulatory approval requirements
   • Before transferring specific categories of data internationally, companies must obtain approval from Chinese regulatory authorities. This applies particularly to personal data or any data deemed critical to national security. The approval process involves a thorough review by authorities, who assess the potential risks of data leaving China and evaluate the company’s data protection protocols.
3. Data processing and consent obligations
   • The new measures require companies to obtain explicit consent from individuals whose data will be transferred outside of China. Companies must inform individuals about the purpose, scope, and recipients of their data, ensuring that users understand and agree to the transfer. This aligns with global privacy trends prioritising user consent and control over personal data.
4. Data localisation for critical information
   • Critical information infrastructure operators (CIIOs) are required to store personal and important data collected within China locally, unless otherwise approved. Data localisation measures aim to enhance security by keeping sensitive information within Chinese jurisdiction, reducing exposure to foreign risks.
5. Transparency in data transfer agreements
   • Companies transferring data across borders must ensure transparency in their data transfer agreements, particularly with foreign entities receiving the data. These agreements should detail security standards, processing guidelines, and compliance with Chinese data protection regulations, ensuring that foreign partners uphold similar data security standards.
6. Penalties for non-compliance
   • The new regulations enforce strict penalties for non-compliance, including fines, operational restrictions, or revocation of business licenses for severe violations. These penalties underscore the importance of adhering to the cross-border data transfer requirements and maintaining regulatory compliance.

Compliance Strategies for Businesses

1. Conduct comprehensive risk assessments
   • To meet security assessment requirements, businesses should implement thorough risk assessments for all cross-border data transfers. Identifying and mitigating risks in advance can help ensure compliance and protect sensitive data during international transfers.
2. Seek early regulatory approvals
   • Given the time-intensive nature of regulatory approvals, companies should apply for necessary permissions early in the transfer planning process. By preparing documentation and complying with regulatory protocols, businesses can expedite the approval process.
3. Enhance consent mechanisms
   • Update consent forms and policies to meet the explicit consent requirements. By providing clear information on data transfer practices, companies can enhance user trust and comply with transparency obligations, ensuring that individuals are informed and in control of their data.
4. Establish data localisation practices
   • For companies identified as CIIOs, implementing data localisation measures can support compliance and protect critical information. Local storage solutions, including working with approved data centres within China, can simplify adherence to localisation requirements.
5. Formalise data transfer agreements
   • Develop detailed data transfer agreements with foreign partners to ensure compliance with China’s data security standards. These agreements should include clauses on data handling, security protocols, and compliance to align with Chinese regulations.

Conclusion

China’s new cross-border data transfer measures reinforce the country’s commitment to data sovereignty and privacy protection. For businesses operating in China or transferring data internationally, adhering to these guidelines is essential for legal compliance and operational stability. By proactively implementing security assessments, obtaining regulatory approvals and enhancing transparency, companies can ensure smooth cross-border data transfers within China’s regulatory framework.