A company in China has the option of relying on (i) the standard
contract (see our article) or (ii) certification to transfer
personal information outside of China, if it is not subject to the
mandatory Cyberspace Administration of China (CAC)
security assessment. Certification is, therefore, an alternative
data transfer mechanism to the standard contract under the Personal
Information Protection Law (PIPL).
On 16 December 2022, the Chinese National Information Security
Standardisation Technical Committee released an updated edition of
the Practice Guidelines for Cybersecurity Standards –
Technical Specification for the Certification of Cross-Border
Processing of Personal Information
(Specification). This sets out the standards and
requirements for designated certification agents to support their
certification processes and provides a guide for data transferors
in relation to their personal information cross-border transfer
activities1.
