China Proposes To Ease Cross-Border Data Transfer Rules

As foreshadowed in our previous client alert highlighting various hurdles to cope with its data export requirements (the "September Update"), China's cybersecurity regulator, the Cybersecurity Administration of China ("CAC"), has recently released a set of draft regulations that are aimed to ease relevant compliance pressure and costs.

Highlights of Proposed Changes

First, the draft Regulations on Standardizing and Promoting Cross-Border Data Flows ("Draft Regulations") makes it clear that "important data", while broadly defined as before to include data which may endanger national security, economic operation, social stability, public health and safety when leaked, will only be so qualified and thus trigger mandatory security assessment if and when the relevant data is explicitly categorized as such by regulators or local authorities. This will remove the potential ambiguities and uncertainties that have been troubling Chinese data exporters.