China Unveils Two Approved Outbound Data Transfer Cases

China Unveils Two Approved Outbound Data Transfer Cases

Under China's data protection regulatory framework, data processors are required to pass a security assessment conducted by the cybersecurity regulator before transferring certain categories or volumes of data out of China. This January, six months after the Cyberspace Administration of China ("CAC") released the Measures on Security Assessment of Outbound Data Transfers ("Measures"), the Beijing counterpart of CAC reported the first two cases where the data processors passed the security assessments led by CAC, which sheds some light on the uncertainty and complexity of the security assessment.

Uncertainty of Reviewing Process and End of Grace Period