China's New Data Security Law Restricts Cross-Border Transfers Of All Data To Foreign Authorities

In Short

The Situation:  Once China's Data Security Law ("DSL") becomes effective on September 1, 2021, it will restrict certain data transfers out of China, including transfers of any data to a foreign judicial or law enforcement authority without prior approval by Chinese authorities. The DSL, however, does not state what activity would constitute a transfer to a foreign judicial or law enforcement authority—such as whether it encompasses cross-border transfers in a purely civil litigation context—or how one may obtain approval. 

The Result: There likely will be a period of uncertainty for multinationals operating in China as the DSL's details are fleshed out. Despite the ambiguities in the new law, Chinese authorities have indicated that they intend to take enforcement action for violations, which may result in significant penalties.