On May 28, 2019, China’s central cybersecurity authority,
the Cyberspace Administration of China, released a draft of its
implementing Measures on Data Security Management (the “Draft
Measures”) for public comment. The Draft Measures are
intended to provide more detailed guidance on how to comply with
China’s Cybersecurity Law, which was originally enacted in
June 2017. Companies doing business in China should be aware of the
proposed updates and prepare for the formal adoption of this
important legislation in China’s data protection
framework.
Key elements of the Draft Measures include the
following:
- Definition of "Important
Data"
China’s Cybersecurity Law imposes data localization
requirements on critical information infrastructure operators
(“CIIOs”), a subset of network operators, to store
“important data” collected and generated in their China
operation within the territory of China and conduct security
assessments before transferring “important
