China's Personal Information Protection Law (PIPL)
took effect 1 November 2021, significantly raising the bar for data
protection compliance in China.
One of the key concerns is the regulation of
international transfers of personal data from China. In addition to
obtaining consent from data subjects, organizations must either go
through an official security assessment, obtain certification by a
specialized body, or enter into standard contractual clauses
prescribed by the Cyberspace Administration of China
(CAC).1 Until recently these requirements remained
unspecified.
On 29 April 2022, the National Information Security
Standardization Technical Committee (TC260, an important policy
making body under the CAC) issued the Draft Guidance on Network
Security Standardized Practice – Technical Specification for
Certification of Personal Information Cross-Border Processing
Activities, shedding some light on the certification mechanism set
forth in the PIPL.
