On April 29, the'Practical Guidance of Cybersecurity
Standards—Technical Specifications for Certification of
Cross-border Handling of Personal Information (Draft for
Comment)'(hereinafter referred to as'Certification
Technical Specifications') was released by the National
Information Security Standardization Technical Committee. It is the
first document to explore personal information protection
certification under Article 38 of Personal Information Protection
Law (PIPL).
Article 38 provides four mechanisms of transferring personal
information abroad, one of which is getting certified by
professional agencies. The other three are (i) conducting security
review by government agencies, (ii) SCC-alike mechanism, i.e.,
entering into standard contracts with data recipients abroad, and
(iii) a catch-all provision, i.e., conditions as stipulated by
applicable laws or regulations. While the security review mechanism
specifies that it applies to critical information
