New Challenges Ahead: How To Comply With Cross-Border Data Transfer Regulation In China

1. INTRODUCTION

Following EU's release of General Data Protection Regulation ("GDPR") and numerous nations or regions' issuance of data protection laws including Russia, Singapore, Australia, Canada, India and South Korea, China's first comprehensive law of data protection, i.e. the Cybersecurity Law of the People's Republic of China ("CSL"), took effect on 1 June 2017.

Compared with EU's so-called strictest privacy law GDPR, the CSL appears to be even stricter in terms of cross-border data transfer for the purposes of which include safeguarding cyberspace sovereignty, national security and public interests, far beyond the ordinary legislative purpose of protecting citizen's personal information. In this regard, the CSL not only targets personal information but also important data. And its supporting legal documents require operators of critical information infrastructure ("CII") to localize data within the territory of China in principle and all network operators