China: Opened consultation on draft interim measures for data security management of accounting firms including data localisation measures

On 2 November 2023, the Ministry of Finance of the People's Republic of China opened a public consultation on the draft interim measures for data security management of accounting firms until 11 December 2023. The draft measures aim at establishing a governance structure and internal management system in order to prevent unauthorised access. The draft measures specify that the accounting firms are required to determine core data, important data and general data based on current regulations and the industry standards of the audited entities. In particular, for core data, the firms should implement a protection mechanism, establish internal dedicated storage space and use encryption, and for important data, implement standardised processing procedures, store data in information systems that are not directly accessible from the internet and control personnel access. In the case of general data, role-based authorisation access control should be established. Furthermore, the draft measures specify that accounting firms' audit work documents, related data and encryption keys have to be stored within the country and cannot be backed up overseas.