China Issues Draft Certification Guidelines For Cross-Border Processing Of Personal Information

In China, personal information ("PI") may be transferred overseas when it is essential for business operations, subject to a number of conditions as stipulated under the Personal Information Protection Law (2021) ("PIPL"),¹ among which are (i) PI protection certification by a specialized institution in accordance with the provisions of the Cyberspace Administration of China ("CAC") (PIPL Article 38(2)), (ii) a CAC-initiated security assessment (required of Critical Information Infrastructure Operators or when the number of PI meets a quantitative threshold) (PIPL Article 38(1)) or (iii) execution of a standardized contract formulated by CAC (PIPL Article 38(3)).

To implement Article 38(2) of the PIPL and to provide the foundation and basic requirements for establishment of the PI protection certification system for purposes of PI cross-border processing, the National Information Security Standardization Technical Committee ("TC260") on April 29, 2022 published for