China To Implement Widespread Data Localization For Personal Information And Important Data

On 11 April 2017 the Cyberspace Administration of China (CAC) released the "Measures on the security assessment of cross-border transfer of personal information and important data (Draft for comments)" (the Measures) for public comments. The Measures are at first to be understood as the complement of the data localization provision of the Cybersecurity Law (CSL) laid in Article 37 for Critical Information Infrastructure (CII), which stated that "a security assessment shall be conducted in accordance with the measures formulated by the CAC in concert with relevant departments under the State Council". However, the Measures do not solely focus on the data localization obligations and the requirements to undergo a security assessment for CII to proceed with cross-border transfer of personal information and important data. The Measures further expand the scope of obligations to the whole spectrum of Network Operators while further creating new obligations supplementing