Back in year 2015, China made cybersecurity an integrated part of its national security with the introduction of the National Security Law (NSL). This laid the groundwork for further regulations, and on 1 June 2017, the Cybersecurity Law (CSL) came into effect. The CSL sets broad rules for companies to follow in managing and protecting their online networks. In 2021, China continued to strengthen its legal framework with the implementation of the Data Security Law (DSL) and the Personal Information Protection Law (PIPL). Together, these laws created clearer rules for how data should be handled. With additional guidelines and supporting regulations, China has built a comprehensive system to oversee both data security and cybersecurity for businesses.
In March 2024, the Cyberspace Administration of China (CAC) introduced the Regulations on Promoting and Regulating Cross-border Data Flows (the 2024 Regulation). This new regulation highlights the growing focus on data protection and marks a key step in China’s control over how data can move across borders. With this update, it is a good time to explore several important topics under China’s legal framework for data protection, including data classification, personal information protection and supervision of cross-border data transfers, especially to understand how these rules and changes would impact foreign businesses operating in China.
Obligations of Critical Information Infrastructure Operators (CIIOs) under CSL
The CSL governs the construction, operation, maintenance and use of networks, as well as the oversight of cybersecurity within China. A key provision, Article 31, emphasizes the protection of critical information infrastructures (CIIs) in vital sectors and industries, like energy, transportation, finance, public services, e-government, and communications and information services, as well as other CIIs where any data that, once tampered with, damaged or leaked, may significantly endanger national security, economic operation, livelihood of people and public interest.
CIIOs in China are required to store all personal information and important data collected and generated within the country. If there is a need to transfer abroad, CIIOs must first complete a data security review through CAC’s data export reporting system (https://sjcj.cac.gov.cn), following guidelines set by the CAC and the State Council. Additionally, CIIOs must perform an annual security and risk assessment of their networks, either by themselves or entrusting cybersecurity service agencies. The results, together with any recommended improvements, should be submitted to the relevant authorities, with the Ministry of Public Security currently leading CIIs protection nationally, whereas sectoral regulators will be responsible for developing rules for designating CIIs in their areas of responsibility, and the CAC plays a coordinating role.
DSL and data classification
The DSL governs data processing activities within China and related security check. It has extraterritorial reach with respect to data processing carried out outside China if such activities threaten national security, public interests, or the legitimate rights and interests of Chinese citizens and organizations.
The DSL introduces a data classification system that is structured hierarchically, categorizing data based on its significance. Different levels of protection standards and requirements are executed accordingly. At the top is “core data,” which is defined to include data crucial to national security, lifeline of national economy, important aspects of people’s livelihoods, and major public interests. Any data that is important enough to affect political security will also fall under the category of “core data.”
The next level is “important data,” the detailed definition and scope of which will be outlined in “important data catalogues.” National authorities, alongside regional, departmental and industrial regulators shall have the discretion to develop their own catalogues for important data within their respective domains. So far we note that a nationwide guideline for identifying “important data” has been published already and shall take effect from October 2024 whilst some industries (to name a few, industrial, automotive, telecommunications) have released their own rules or guidance on “important data” identification. Overall, as what is generally provided for in the DSL, “important data” should cover such critical data that, once tampered with, damaged, leaked or illegally obtained or used, may directly endanger national security, economic operation, social stability, and public health and safety.
“Important data” handlers are required to fulfil the following major obligations in their data processing activities: (1) designation of a specific responsible person and establishment of an internal management organization to handle data security, (2) data encryption and back-up, (3) conduct of risk assessment in respect of processing activities and report to regulators, (4) performance of data security review on data export, (5) filing of “important data” catalogue that is stipulated by the data processor itself with regulators. By now this last requirement only applies to handlers in industrial and informatization sectors. With the entry into effect of the upcoming Regulations on Network Data Security Management from 2025, all network data handlers will then be required to identify and file the “important data” they process with regulators.
PIPL and cross-border data transfer
China’s PIPL shares many goals with the EU’s General Data Protection Regulation (GDPR), aiming to strengthen individuals’ rights to control how their personal information is collected and used by third parties. The PIPL also has extraterritorial reach, applying to activities conducted outside China that are aimed at providing products or services to individuals in China or analyzing their behaviors. In the spirit of such enhanced protection for individual data subjects, “personal information” is broadly defined as information that is capable of identifying natural persons to the exclusion only of irreversibly anonymized information. A sub-category of “sensitive personal information” is also introduced which a higher level of protection is accorded to. The sensitiveness relates to data subjects’ biometrics, religious beliefs, health, finances, geographical locations and personal information of young children no older than 14 years.
Before handlers can process any personal information, one of the following conditions should be fulfilled:
- obtain informed consent from data subject. Where consent is not required:
- if the intended data processing is necessary for the conclusion or performance of a contract to which the individual concerned is a party, or for the implementation of human resource management
- if it is necessary for the fulfilment of legal duties or obligations
- if it is necessary for responding to public health emergencies or for protecting people’s life, health or property in emergency situations;
- for news reporting on a matter of public concern and to the reasonable extent
- processing of personal information that has been disclosed and to the reasonable extent
- accurate and complete disclosure of all major details relating to the intended processing activities to the data subjects concerned. Major items include:
- contact details of processors
- how data will be processed and for how long it will be retained. Also, the purpose thereof and the scope of personal information to be involved
- methods and procedures for individuals to exercise their rights to protect their personal information
When it comes to “sensitive personal information,” additional requirements are imposed. They are: (1) specific purpose and necessity for the intended processing activities must be identified, (2) separate prior consent is a must, and (3) pre-processing impact assessment should be conducted. This last procedural requirement will also come into play in other circumstances where there is an international data transfer, delegation of data processing activities or provision of the data concerned to other data handlers, or where data processing is required for automated decision making process.
In addition to these requirements that need to be fulfilled before data handlers can proceed with any processing activities, the PIPL imposes several rules on code of conduct when processing is performed.
For example, processing should be limited only to the minimum extent that is required for the purpose intended. Once the purpose is satisfied, data processed should be deleted from record. Several data protection mechanisms should also be put in place. Amongst others, personal data handlers are required to formulate internal management and operational protocols in respect of data processing, as well as contingency plans when security emergencies occur. Regular self-audits, training organization and technical measures implementation are also needed for personal information protection. The PIPL further requires data localization if the volume of data to be processed achieves certain threshold. This volume-based assessment also matters in determination of the question on whether an information protection officer should be appointed. Though for both cases, where the specific thresholds lie is yet to be confirmed by regulators.
International data transfer is another area of practice that may trigger biggest compliance risk for MNCs operating businesses in China, since more often than not and for many foreign investments we observe, the actual administration and management lies overseas.
Extra requirements and codes of conduct need to be followed by processors transferring personal data abroad:
- approval from competent authorities is required for data transfer to foreign regulators and governmental authorities
- pre-export impact assessment should be conducted and the results be recorded for three years
- complete and accurate disclosure of information on overseas recipient(s), the purpose and manner of processing by the latter(s), scope of personal data involved as well as the methods and procedures for individuals to exercise their rights to protect their personal information
- separate prior consent from data subjects is to be obtained
- completion of one of the following administrative procedural requirements: i. security review, ii. personal information protection certification, or iii. execution of cross-border data transfer contract
Having said the above, we saw a legal trend with the introduction of the 2024 Regulation to relax the administrative procedural burden that was previously exerted on personal data exporter. Now an extensive list of exemptions has been implemented following the entry into effect thereof; to name a few:
- to carry out cross-border human resources management in the company
- to fulfill a contract to which the data subject is a party; this will cover a wide range of cross-border activities (e.g., shopping, courier, payment, bank account opening, visa application)
- non-sensitive personal information transfers by data handlers that are not critical information infrastructure operators and the aggregate volume of data to be exported is less than 100,000 data subjects within the current year
- to conduct international trade, cross-border transportation, academic cooperation, cross-border production and manufacture, as well as marketing, if no important data or personal information is involved in the export
Kindly note that the exemptions from the abovementioned procedural requirements do not however release data handlers from complying with other existing requirements mentioned above, which are obtainment of separate prior consent, completion of pre-export impact assessment, and full disclosure of information on recipient(s).
Practical implications
- With the introduction of a categorical and hierarchical protection system based on the importance of data, it is advisable for multinational companies to implement ongoing monitor in terms of the type, significance and quantity of the data collected, stored, processed, transferred and used during their business operations, and implement the appropriate protection mechanisms
- Due regard to be accorded to catalogues of “important data” that are or will be issued by regional and industrial authorities as basis for the assessment and identification in respect of the significance of data concerned
- Multinational companies seeking to transferring data abroad including without limitation to foreign regulators would be prudent to seek legal advice before undertaking such activities
- Marketing activities that use personal data to assess data subjects’ behavior, interest, financial and credit status, health conditions, and to ultimately form a decision through automated decision making systems are regulated under Chinese laws. Pre-processing impact assessment should be completed
How can we help you?
Catherine Yan
Partner