On 31 August 2022, the Cyberspace Administration of China
("CAC") issued the first edition of the Guidelines on the
Application of Security Assessment on Cross-border Data Transfer
("Guidelines")
(数据出境安全评估申报指南(第一版))
to clarify how organisations in China can apply to CAC for a
security assessment for cross-border data transfer. The Guidelines,
which are intended to be guidance for the Measures for Security
Assessment of Cross-border Data Transfer ("Measures")
(数据出境安全评估办法),
were released one day before the Measures took effect on 1
September 2022.
The Guidelines repeats the circumstances where a mandatory
CAC-led security assessment is required under the Measures: (i)
transfers of important data out of China; (ii) transfers of
personal information out of China by critical information
infrastructure operators or data processing entities that process
personal information of over one million individuals; (iii)
transfers of personal information out of China since 1
