On 24 February 2023, the Chinese Internet Information Office adopted Standard Contractual Measures for Exporting Personal Information Abroad, which will become effective from 1 June 2023. The main objective of the Standard Measures is to protect personal information and control the transfer of data overseas. It is emphasised that personal information exportation activities must follow a combination of independent contracting and record management to ensure the protection of rights and interests and risk prevention, thereby ensuring the secure and unrestricted flow of personal information across borders. Data controllers who supply personal data overseas and who are obligated to establish standard contracts must comply with certain standards, such as being a non-critical information infrastructure operator, a processor of personal information of less than one million individuals, a provider of personal information outside the country of less than 100'000 individuals in aggregate since January 1 of the previous year, and a provider of sensitive personal information outside the country of less than 10'000 individuals in aggregate since January 1 of the previous year. Before providing information overseas, data processors must perform personal information protection impact assessments and file a report on its assessment with its local, provincial network information department. The Measures also establish guidelines for supervision and management, legal liability, and requirements for compliance and rectification.
Original source