China: Closed consultation on Certification Requirements for Cross-Border Transmission of Personal Information

On 15 May 2023, China's National Information Security Standardisation Technical Committee (TC260) closed its consultation on the draft “Certification Requirements for Cross-Border Transmisssion of Personal Information”. The Certification Requirements set out the personal information protection measures applicable to cross-border transfers and are to be used by the professional certification bodies certifying cross-border transfers of personal information. In particular, the Certification Requirements establish the basic principles and general requirements for cross-border transfer of information by personal information processors, as well as the obligations regarding the protection of data subjects’ rights. Both the processor and the overseas recipient are required to adhere to principles of lawfulness, good faith, information quality, equal protection, and clear responsibility. The Certification Requirements also set out the basic form of the required pre-transfer contract between processor and recipient. Both parties would be required to implement appropriate organisational structures to enable compliance with data transfer rules and agree on and follow the same rules for cross-border processing of personal information. Additionally, the processor would be required to carry out impact assessments regarding their cross-border data transfer activities. Finally, the Certification Requirements require both parties to recognise and facilitate the exercise of a number of data subject rights.