Compliance Management for Cross-border Transfers of Personal Information

On 7 July 2022, the Cyberspace Administration of China (CAC) issued the “Measures for Cross-border Data Transfer Security Assessment” (the “Security Assessment Measures”), effective from 1 September 2022. The Security Assessment Measures specify the circumstances under which a cross-border data transfer security assessment (the “Security Assessment”) shall be declared, and proposes specific requirements for the Security Assessment.

On 4 November 2022, the CAC issued the “Announcement on the Implementation of Personal Information Protection Certification” (the “Announcement”), effective from 4 November 2022. The Announcement specifies the implementation rules for personal information protection certification, which requires personal information processors to comply with GB/T 35273 “Information Security Technology Personal Information Security Specification”. Processors engaged in cross-border processing activities shall also comply with the requirements of TC260-PG-20222A “Security Certification Specification for Personal Information Cross-border Processing Activities” (the “Certification Specification”).

On 24 February 2023, the CAC issued “Measures for Standard Contracts for Cross-border Transfer of Personal Information” (the “Measures for Standard Contract”) and the “Personal Information Cross-border Transfer Standard Contract” (the “Standard Contract”), effective from 1 June 2023.

With that, the three compliance paths for cross-border transfer of personal information have been defined. Starting with the new regulation “Measures for Standard Contracts for Cross-border Transfer of Personal Information” and relevant applicable requirements, and leveraging our service experience of personal information protection management, KPMG prepared this publication to provide insights and recommendations about how companies can adequately address cross-border data transfer compliance requirements and how companies should effectively implement personal information protection management and impact assessment, for companies’ considerations and references.