China Moves Closer To Requiring Personal Data To Be Kept In China

On June 1, 2017 China's new Cyber Security Law will come into effect. This law moves China one step closer to requiring that at least some internet companies and other data handlers keep their user's personal data within China's borders. Other new laws, still under debate, would expand that requirement to all companies.  

The Cyber Security Law

The Cyber Security Law requires that "key information infrastructure operators" store in China any personal information produced during operations in China. However, this is not an absolute requirement. The Cyber Security Law allows that where it is "really necessary" to provide such data to overseas parties due to "business requirements", the company must undertake a security assessment in accordance with rules to be issued by China's Cyberspace Administration ("CAC").