The Cyberspace Administration of China ("CAC") on
September 28, 2023 issued the draft Provisions on the Regulation
and Promotion of Cross-Border Data Flows ("draft
Provisions"),1 just one year after China's data
export security management framework was formally
established.2The fact that CAC released the draft
shortly before China's week-long National Holiday and set a
short period for public comment (through October 15) suggests that
CAC intends to finalize the draft and promulgate the Provisions
soon.
The current data export compliance regime is underpinned by
three alternative pillars: a mandatory data export security
assessment when certain thresholds are crossed, personal
information ("PI") standard contract clauses
("SCC") filing, or PI protection certification
("PIPC").