In recent years, the Chinese government has placed significant emphasis on regulating data export flows, which has emerged as one of the most significant challenges for multinational enterprises operating in China.
China’s data protection legal and regulatory framework is principally governed by its “three pillars”: the Cybersecurity Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, and the Personal Information Protection Law of the People's Republic of China (together, “Data Protection Laws”). The Data Protection Laws are generally intended to encourage data localization and only permit data exports under certain circumstances, subject to certain safeguard measures. Since 2024, these data export safeguards have been implemented with a view toward balancing between protecting China’s vital interests while not unduly burdening cross-border business transactions.
In this article, we introduce the latest developments and outline the key implications for multinationals doing business in China or with Chinese counterparties.
1. Data exports regulated under PRC law
1.1 What types of data are subject to export restrictions?
Unlike under the GDPR, business operators exporting data out of China must direct their focus not only on personal data but must consider whether the data may pose risks to national or public security. Stated simply, there are two general criteria to consider in scoping whether data is subject to export restrictions under the PRC data protection laws.
(i) Personal data. Depending on whether the data can, directly or indirectly, identify or link to a specific natural person in China, data can be classified as “personal data” or “non-personal data”.
(ii) National interest. Data viewed through the lens of national interest can be classified in order of sensitivity as “core data”, “important data”, or “general data”. Core data can be understood as a subset of “important data”, which has more direct and significant impact on China’s national security, social stability, economic operation and public interests. Each industry and regional administrative department have been directed to formulate relevant identification rules and determine a catalog of which types of data it views as “important” for this purpose. Regulators have made clear that data is to be considered “important” only if it has been identified as such by a competent authority.
In principle, non-personal general data is freely exportable from China. Exceptions exist, for example if the data is subject to certain industry-specific restrictions (e.g., medical and financial industries) or the export is otherwise restricted due to existing legal principles (e.g., providing data to a foreign judicial or law enforcement authority in response to a request for international legal assistance).
1.2 What types of data processing are considered exports?
Regulated data exports include: (i) transferring data collected and generated in China to offshore parties; (ii) providing offshore institutions, organizations, and individuals with access rights to data stored or generated in China; and (iii) processing data outside China, provided it is subject to the extraterritorial effect of the Data Protection Laws.
While the above explanation clarifies the definition of “data export”, a case-by-case analysis remains essential in practice when identifying data export activities and determining the appropriate offshore receivers in multinational corporations' cross-border operations. This is particularly crucial when data exports involve offshore data processors.
2. PRC data export safeguard measures
Many multinational corporations are well-versed in the data export obligations under GDPR and may quickly recognize differences when comparing these obligations to those stipulated by the Data Protection Laws. Notably, the safeguards available under GDPR for exporting personal data do not apply to cross-border data transfers from China, in particular, adequacy decisions and binding corporate rules. By contrast, the Data Protection Laws delineate their own significantly more concise set of safeguards for data exports, including the following procedures.
2.1 Security assessment
A mandatory government security assessment by the Cyberspace Administration of China (the “CAC”, the primary authority for data compliance supervision in China) is required before exporting important data, as well as personal data under certain circumstances (e.g., cumulatively exporting sensitive personal data of more than 10,000 since January 1 of the current year). The CAC is authorized to approve or reject the proposed data exports upon a substantive assessment.
In principle, the entire security assessment process should be completed within 57 working days. However, the CAC, at its discretion, is entitled to extend the time period for assessment without limitation where the data export is considered complicated or additional documents are required. Given this, it is important for business operators to begin a dialogue with their advisors in advance to avoid any undue impact on business continuity.
2.2 Execution and filing of China standard contract (“China SCC”)
The PRC data protection laws permit business operators relying on the China SCC approach to export personal data, provided that such business operators are not subject to a mandatory security assessment. The SCC approach is generally considered the most common practice globally and is a feasible means for multinationals to fulfil their data export obligations.
Under this approach, business operators should conclude the China SCC with the offshore receiver, in strict accordance with the template released by the CAC, and file the executed version with the CAC. Unlike the GDPR’s four-module approach in applying to various processing scenarios, China SCC adopts a one-size-fits-all approach, only providing one template for different data export scenarios with Chinese law being the governing law. Thus, this template may substantially rebalance the relationship between PRC business operators and offshore receivers by imposing on them with substantial obligations.
2.3 Obtaining a personal data protection certification
In addition to the China SCC approach, business operators not subject to a mandatory security assessment may alternatively adopt the certification approach, i.e., obtaining a certification from a CAC-designated organization. However, few business operators have chosen to pursue the certification process.
Notably, to promote data flows between foreign-invested enterprises and their headquarters, China recently has introduced exemptions from the above safeguard measures for certain data export scenarios. Such circumstances primarily include the following.
(i) Contract performance exemption - exporting an individual’s personal data is for the purpose of entering into or performing contracts to which the individual is a party, such as contracts related to cross-border shopping, delivery, remittances, payment, account opening, airline tickets and hotel bookings, visa application processing, examinations, etc.
(ii) HR management exemption - exporting employees’ personal data is necessary for implementing cross-border HR management in accordance with lawfully formulated labor policies and signed collective contracts; and
(iii) Emergency exemption - export of an individual’s personal data is to protect the life, health, and property safety of natural persons in exigent circumstances.
The above safeguard exemptions apply only with certain preconditions; therefore, business operators should carefully assess the applicability when relying on an exemption. While these safeguards may not apply to all data export scenarios, it is essential to recognize that data exports remain subject to other obligations, including transparency, legal basis for processing, and personal data protection impact assessments.
3. Implications and recommendations for multinationals
In this regard, we recommend business operators to consider their next steps to ensure data compliance when doing business in China, which include the following.
- Data mapping. Review your PRC business to understand its data export scenarios, identify data export flows, assess the applicability of exemptions, and adopt appropriate safeguards for subject export scenarios.
- Gap analysis. Assess your PRC data compliance practices, identify the existing compliance gaps for data exports and take appropriate measures to mitigate.
- Negotiation with stakeholders. Identify the stakeholders along the data flows and begin discussions for creating documentation to comply with PRC law requirements.
- Periodically review data exports. Keep track of and periodically review data export scenarios for a timely knowledge of data export status and adjust compliance strategies as needed.
Article provided by INPLP member: David Tang (Han Kun, China)
Discover more about the INPLP and the INPLP-Members
Dr. Tobias Höllwarth (Managing Director INPLP)
