Extracts :

Extract :

"In terms of transfers of personal information to third parties, the PIPL requires the consent of data subjects, provided that there is no non-consent basis for processing. The PIPL provides three methods for personal information handlers to transfer personal information out of China: passing a security assessment administered by the CAC; undertaking a personal information protection certification conducted by recognized institutions in accordance with relevant regulations of the CAC; or executing a standard contract for cross-border transfer provided by the CAC. Security assessment If the cross-border data transfer satisfies any of the following circumstances, personal information handlers shall, through the local cyberspace administration at the provincial level, apply for mandatory security assessment for such transfer: transfer of important data outside of China; transfer of personal information outside of China by a CII operator, or a personal information processor, processing more than one million individuals' personal information; cumulative transfer of personal information of more than 100,000 individuals from 1 Jan of the preceding calendar year or cumulative transfer of 'sensitive' personal information of more than 10,000 individuals from 1 Jan of the preceding calendar year; or other circumstances that require the security assessment of cross-border transfer provided by the CAC. In terms of mandatory security assessment, the cyberspace administration at the provincial level must complete the formality review within five business days upon receipt of the application documents. If such documents satisfy the formality requirements, the cyberspace administration at the provincial level would submit such documents to the CAC. The CAC shall notify the applicant in writing whether it accepts the application within seven business days upon receipt of application documents. The CAC shall complete the security assessment within 45 business days after issuing the written notification of acceptance. In cases of complexity or supplementing/amending application documents, appropriate extensions are allowed. In general, most applications would not fall into the extension scenario. The estimated time for the completion of the security assessment by the CAC is approximately 57 business days. If the relevant personal information handlers object to the result of the security assessment, they may apply for re-assessment within 15 business days upon receipt of such result. The re-assessment would be final and binding. For non-CII operators or personal information handlers that process personal information below the aforementioned threshold amount prescribed by the CAC, there are two other options for cross-border data transfers. One option is to obtain a personal information protection certification awarded by a recognized institution by the CAC. The other option, and the most likely to be used, is to execute a data transfer agreement with the recipient located outside of China, in compliance with a standard contract to be provided by the CAC. For cross-border transfers of personal information, in addition to the above requirements, a personal information handler must also inform individuals of: the identity and contact information of the data recipient(s); the purpose(s) and method(s) of data processing; the type(s) of personal information to be transferred; and how individuals can exercise their rights under the PIPL with respect to the data recipient(s). Personal information handlers must also obtain separate consent from individuals for the cross-border transfer of their personal information unless there is a legal basis for such transfer. Additionally, cross-border transfers of personal information made for the purpose of providing international judicial and law enforcement assistance must first be approved by a competent Chinese authority."

2023

Reference :

China Data protection overview | DataGuidance

Updated DataGuidance reports

Extracts :

Extract :

"In terms of transfers of personal information to third parties, the PIPL requires the consent of data subjects, provided that there is no non-consent basis for processing. The PIPL provides three methods for personal information handlers to transfer personal information out of China: passing a security assessment administered by the CAC; undertaking a personal information protection certification conducted by recognized institutions in accordance with relevant regulations of the CAC; or executing a standard contract for cross-border transfer provided by the CAC."

2023

Reference :

China Data protection overview | DataGuidance

Updated DataGuidance reports

Extracts :

Extract :

"In terms of transfers of personal information to third parties, the PIPL requires the consent of data subjects, provided that there is no non-consent basis for processing. The PIPL provides three methods for personal information handlers to transfer personal information out of China: passing a security assessment administered by the CAC; undertaking a personal information protection certification conducted by recognized institutions in accordance with relevant regulations of the CAC; or executing a standard contract for cross-border transfer provided by the CAC. Security assessment If the cross-border data transfer satisfies any of the following circumstances, personal information handlers shall, through the local cyberspace administration at the provincial level, apply for mandatory security assessment for such transfer: transfer of important data outside of China; transfer of personal information outside of China by a CII operator, or a personal information processor, processing more than one million individuals' personal information; cumulative transfer of personal information of more than 100,000 individuals from 1 Jan of the preceding calendar year or cumulative transfer of 'sensitive' personal information of more than 10,000 individuals from 1 Jan of the preceding calendar year; or other circumstances that require the security assessment of cross-border transfer provided by the CAC. In terms of mandatory security assessment, the cyberspace administration at the provincial level must complete the formality review within five business days upon receipt of the application documents. If such documents satisfy the formality requirements, the cyberspace administration at the provincial level would submit such documents to the CAC. The CAC shall notify the applicant in writing whether it accepts the application within seven business days upon receipt of application documents. The CAC shall complete the security assessment within 45 business days after issuing the written notification of acceptance. In cases of complexity or supplementing/amending application documents, appropriate extensions are allowed. In general, most applications would not fall into the extension scenario. The estimated time for the completion of the security assessment by the CAC is approximately 57 business days. If the relevant personal information handlers object to the result of the security assessment, they may apply for re-assessment within 15 business days upon receipt of such result. The re-assessment would be final and binding. For non-CII operators or personal information handlers that process personal information below the aforementioned threshold amount prescribed by the CAC, there are two other options for cross-border data transfers. One option is to obtain a personal information protection certification awarded by a recognized institution by the CAC. The other option, and the most likely to be used, is to execute a data transfer agreement with the recipient located outside of China, in compliance with a standard contract to be provided by the CAC. For cross-border transfers of personal information, in addition to the above requirements, a personal information handler must also inform individuals of: the identity and contact information of the data recipient(s); the purpose(s) and method(s) of data processing; the type(s) of personal information to be transferred; and how individuals can exercise their rights under the PIPL with respect to the data recipient(s). Personal information handlers must also obtain separate consent from individuals for the cross-border transfer of their personal information unless there is a legal basis for such transfer. Additionally, cross-border transfers of personal information made for the purpose of providing international judicial and law enforcement assistance must first be approved by a competent Chinese authority."

2023

Reference :

China Data protection overview | DataGuidance

Updated DataGuidance reports

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

International Data transfer Agreements | DataGuidance

Comparison of international data transfer agreements

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2022

Reference :

International Data transfer Agreements | DataGuidance

Comparison of international data transfer agreements

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Extracts :

Extract :

Data entered based on reference.

2023

Reference :

Global Data Security Handbook

BakerMckenzie

Link to reference

Name	Short name	Classification	Jurisdiction	Year of creation
Cyberspace Administration of China (CAC)	CAC	Regulator	Under the government authority	2014
State Administration for Market Regulation (SAMR)		Regulator	Ministry	2018
Ministry of Industry and Information Technology (MIIT)		Regulator	Ministry	2008
National Copyright Administration of China (NCAC)		Regulator	Under the government authority	1985

🇨🇳 China

Data subject classification

Citizens outside their jurisdiction are considered as data subjects : No

Persons within their jurisdiction are considered as data subjects : Yes

Legal entities are considered as data subjects : No

Data controller definition and responsibilities

Organizations located outside the jurisdiction processing regulated subjects data are considered as data controllers within the personal data legislation : Yes

Differentiation between how data controller and data processor are defined : No

Organizations with economic activities within the jurisdiction are considered as data controllers within the personal data legislation : Yes

Organizations located outside the jurisdiction monitoring regulated subjects data are considered as data controllers within the personal data legislation : Yes

Special/sensitive personal data definition

Definition of personal data that are "special" or "sensitive": financial data : Yes

Definition of personal data that are "special" or "sensitive": genetic data : Yes

Definition of personal data that are "special" or "sensitive": medical/health data : Yes

Definition of personal data that are "special" or "sensitive": biometric data : Yes

Definition of personal data that are "special" or "sensitive": criminal records data : Yes

Definition of personal data that are "special" or "sensitive": racial/ethnic origin : Yes

Definition of personal data that are "special" or "sensitive": political opinions : Yes

Definition of personal data that are "special" or "sensitive": religious/philosophical beliefs : Yes

Definition of personal data that are "special" or "sensitive": trade union membership : Yes

Definition of personal data that are "special" or "sensitive": geo-location data : Yes

Legal bases for data processing

Potential legal bases for processing personal data: appropriate notice has been provided to or made available to the data subject : No

Potential legal bases for processing personal data: the data subject has provided consent to the processing for the identified purposes : Yes

Potential legal bases for processing personal data: the personal data is necessary to perform a contract with the data subject : Yes

Potential legal bases for processing personal data: the personal data is necessary to comply with a legal obligation : Yes

Potential legal bases for processing personal data: the personal data is necessary to protect the vital interests of a natural person : Yes

Potential legal bases for processing personal data: the personal data is necessary for a public interest : Yes

Potential legal bases for processing personal data: the personal data is necessary to fulfil a legitimate interest of the controller or third party : No

Enforcement and penalties

Provision of administrative penalties by laws : Yes

Max value of monetary penalties for violations (in euros) : 6500000

Consideration of turnover rates for penalties? : Yes

Provision of criminal penalties - fines : Yes

Subject private remedies - presence of individual personal actions? : Yes

Subject private remedies - representative actions? : Yes

Subject private remedies - class actions? : No

Subject private remedies - file complaints with Data Protection Authorities? : Yes

Provision of criminal penalties - imprisonment : Yes

Data processing and security controls

Audit or supervise Data Processors : Yes

Requirement of a DPIA : Yes

Ensuring encryption/pseudonymisation as a security control : Yes

Requirement for Controller to notify subjects of a data breach : Yes

Requirement for Controller to notify DPA of a data breach : Yes

Requirement for Processor to notify controller of data breach : No

Requirement for Processor to notify DPA of data breach : No

Requirement for Processor to notify subjects of data breach : No

Obligation to maintain information security control to protect personal data from unauthorized access or processing: general technical/physical/organizational security controls : Yes

Rights of data subjects

Right to object data use or/opt out : Yes

Right to data portability : Yes

Right against automated decision making : Yes

Right to be informed : Yes

Consent required for processing children's data : Yes

Right to access information : Yes

Right to rectification : Yes

Right to erase : Yes

Right to withdraw consent : Yes

Right to restrict data processing : Yes

International data transfer and data localization

Legal basis for international data transfer: approved jurisdictions : Yes

Legal basis for international data transfer: approved standard contractual clauses : Yes

Legal basis for international data transfer: derogations, such as consent, contract performance, necessity to establish, exercise or defend legal claims : Yes

Legal basis for international data transfer: binding corporate rules : No

Data localisation requirements: retention of personal data in local jurisdiction : Yes

Data localisation requirements: tax or financial record laws : No

Legal basis for international data transfer: EU/EEA adequacy : No

Legal basis for international data transfer: Convention 108 : No

Data localisation requirements: national security laws : Yes

Legal basis for international data transfer: APEC CBPRs : Yes

Data localisation requirements (such data is part of another type of record or dataset): retention or storage of personal data in the local jurisdiction or otherwise prohibit the transfer or disclosure of the personal data outside of the local jurisdiction : Yes

Data localisation requirements: anti-investigatory/blocking statutes that restrict any activity on local territory that aids a foreign government investigation : Yes

Data localisation requirements: other data localization regulations (export control laws/medical laws/employment laws etc.) : Yes

Data protection officer (DPO) requirements

Consulting the supervisory authority (DPA) before data processing : No

Mandatory appointment of a DPO : Yes

Requirement of professional/legal qualification/expert knowledge for DPO : No

Clear DPO role specification : Yes

Group appointments: a group of undertakings to appoint a single DPO : No