The Cyberspace Administration of China (the "CAC")
launched a public consultation on the draft Administrative Measures
on Data Security (the "Draft Measures") on May 28, 2019.
This consultation falls in the middle of the publication of the
drafts for two other data protection rules, namely the Measures for
Security Assessment for Cross-border Transfer of Personal
Information and the Measures for Cybersecurity Review.
Together, these three measures will implement a significant
portion of the Cyber Security Law (the "CSL") and become
the first set of binding laws focused solely on data protection,
adopting certain rules from the non-binding Personal Information
Security Specification. The Draft Measures were published just over
a year after the General Data Protection Regulation (the
"GDPR") came into effect in the EU and certain
similarities between the two regimes are apparent.
