In February 2023, the Cybersecurity Administration of China
(CAC) issued the Measures for the Standard Contract for
Outbound Cross-Border Transfer of Personal Information (the
Measures) which became effective on June 1, 2023. It will be
important for global companies to comply with these Measures.
Currently, the CAC is one of the most active enforcement agencies
in China. Furthermore, the penalties can be substantial, including
serious business disruption and fines of the greater of RMB 50
million (~USD 7 million) or 5% of the prior year's revenue.
The Measures provide guidance and procedures for the adoption of
Standard Contractual Clauses (SCC) to allow for cross-border
transfers of personal information and provide a six-month grace
period to execute the SCCs and file for recording with the
provincial-level CAC. Companies that obtain personal information
from China should take advantage of this window to bring their
practices into compliance.
