2019 China Data Protection & Cybersecurity Annual Report

Increasingly Complex Legal Regime

Two years after the enactment of the Cybersecurity Law of China ("CSL"), various implementing regulations and standards continued to roll out throughout 2019. In the area of personal data protection, in mid 2019 a draft regulation on data localization requirement was released – the Measures for Security Assessment for Cross-border Transfer of Personal Information (Draft for Comments). While the CSL stipulates a general requirement of conducting security assessment for cross-border transfer of personal data collected by critical information infrastructure operators ("CIIOs"), the draft regulation provides in detail how the assessment should be carried out. It updates an older draft published in 2017 in which cross-border transfer of both personal data and important data were addressed. This draft regulation implies that personal data export will be handled separately from important data.