China: Closed consultation on Administrative Measures for Personal Information Protection Compliance Audit including cross-border data transfer measures

Description

Closed consultation on Administrative Measures for Personal Information Protection Compliance Audit including cross-border data transfer measures

On 2 September 2023, the Cyberspace Administration of China (CAC) closed its consultation on the draft Administrative Measures for Personal Information Protection Compliance Audit. According to the Measures, service providers processing personal information on more than 1 million people, and providers who have processed the personal information of 100,000 people or sensitive personal information of 10,000 people overseas during the previous year, must undergo security assessments by the CAC. In addition, transfers of personal data overseas to foreign judicial or law enforcement agencies require approval from Chinese authorities. Any data transfers may only occur after the processor has ensured recipients meet China's personal information protection standards, by assessing the recipient's data protection capabilities, informing them of China's requirements, and signing agreements requiring protection measures. Organisations should also regularly check that overseas recipients are processing the data according to agreements and urge them to fulfil protection obligations.

Original source

Scope

Policy Area
Data governance
Policy Instrument
Cross-border data transfer regulation
Regulated Economic Activity
cross-cutting
Implementation Level
national
Government Branch
executive
Government Body
other regulatory body

Complete timeline of this policy change

Hide details
2023-08-03
in consultation

On 3 August 2023, the Cyberspace Administration of China (CAC) opened a consultation on the draft A…

2023-09-02
processing consultation

On 2 September 2023, the Cyberspace Administration of China (CAC) closed its consultation on the dr…

2024-05-20
adopted

On 20 May 2024, the Cyberspace Administration of China (CAC) adopted the Measures for the Administr…

2025-02-12
in grace period

On 12 February 2025, the Cyberspace Administration of China (CAC) released the Measures for the Adm…

2025-05-01
in force

On 1 May 2025, the Cyberspace Administration of China (CAC)’s Measures for the Administration of Co…

We use cookies and other technologies to perform analytics on our website. By opting in, you consent to the use by us and our third-party partners of cookies and data gathered from your use of our platform. See our Privacy Policy to learn more about the use of data and your rights.