Sending Personal Information Out Of China – Regulatory Updates

Many businesses operating in Mainland China, whether multinational corporations ("MNCs") or domestic companies, transfer personal information ("PI") out of the country in the ordinary course of business. Such outbound PI transfer is governed by the PRC Personal Protection Information Law  ("PIPL") and ancillary implementation rules. 

In our previous article published in July 2022 (Cross-border Data Transfer between Hong Kong and Mainland China – What do we need to Know?), we briefly outlined the three routes through which PRC data processors may lawfully export PI, namely by:

1. passing the mandatory data security assessment conducted by the Cyberspace Administration of China ("CAC") ("Security Assessment route");