China Finalizes Measures on the Standard Contract for Cross-Border Transfers of Personal Information
On February 24, 2023, the Cyberspace Administration of China ("CAC") issued the long-awaited Measures on the Standard Contract for Outbound Cross-Border Transfer of Personal Information ("Measures").
Under the Personal Information Protection Law ("PIPL"), before transferring personal information ("PI") out of China, PI handlers currently must satisfy one of the following procedural requirements:
- Pass a security assessment ("Security Assessment") by the CAC;
- Obtain a PI protection certification from a CAC authorized institution; or
- Enter into a Standard Contract ("SC") with the data recipient.
The Measures require:
- The parties to use the template SC attached to the Measures. The parties may add provisions as long as they do not conflict with the SC;
- The PI handler to file the SC with the provincial level CAC within 10 business days after the SC becomes effective, together with the related PI risk assessment; and
- Recipients outside of China to notify the PI handler immediately if they receive a request from a foreign government to provide PI transferred under the SC.
Although CAC approval is not required, the CAC has the right to review and require corrections if they consider the PI transfer to be non-compliant.
The SC may only be used if the PI Handler is not required to undergo a Security Assessment due to the volume or nature of data being transferred. The Measures expressly provide that PI handlers may not divide or otherwise structure PI transfers to avoid the requirement for a Security Assessment.
The Measures will become effective on June 1, 2023. There is a further grace period of six months until December 1, 2023, for companies to bring their cross-border transfers into compliance, including those transfers that occurred before June 1, 2023. Companies that fail to comply will be subject to penalties under the PIPL, which could range from correction orders or suspension of PI transfers to financial penalties up to RMB 50 million or up to 5% of the PI handlers' revenue of the previous year.
The Measures will impact almost every organization transferring PI from China. Companies that have not already done so should immediately review their existing PI transfer arrangements in light of the Measures.
Jones Day publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information purposes only and may not be quoted or referred to in any other publication or proceeding without the prior written consent of the Firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our “Contact Us” form, which can be found on our website at www.jonesday.com. The mailing of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship. The views set forth herein are the personal views of the authors and do not necessarily reflect those of the Firm.