China's New Cross-Border Data Transfer Rules Substantially Reduce Compliance Burdens For Multinational Employers

• Published date: 02 April 2024
• Subject Matter: mployment and HR, Law Practice Management, Compliance, Health & Safety, Employee Rights/ Labour Relations, Human Resource Management
• Law Firm: Littler Mendelson
• Author: Mr Philip Gordon, Xi (Grace) Yang, Zoe Argento and Kwabena Appenteng

Multinational employers operating in China have been waiting since September 2023 for the Cyberspace Administration of China (CAC) to finalize proposed revisions to its complex and burdensome rules for cross-border data transfers. Relief arrived on March 22, 2024, when the CAC published the "Provisions on Promoting and Regulating Cross-border Data Flows" (the "Approved Provisions"), which went into effect on the same day. The Approved Provisions adopt three key changes, first proposed in September 2023, to the CAC's original cross-border data transfer rules, which were published in February 2023. While these changes will substantially reduce multinational employers' compliance burdens when transferring human resources (HR) data and business contact information (BCI) out of China, the changes do not eliminate all compliance obligations. In this ASAP, we will explain the new, burden-reducing exemptions and describe the compliance obligations that remain in effect.

Statutory and Regulatory Background

Since its November 1, 2021 effective date, China's Personal Information Protection Law (PIPL) has established the following requirements for transfers of personal information overseas:

• Providing notice to data subjects of the overseas transfer of their personal information;
• Obtaining the express consent of the data subject to the cross-border data transfer;
• Conducting a "transfer impact assessment" (TIA) to assess the risks associated with the data transfer; and
• Executing a standard data contract issued by the CAC.

On February 22, 2023, the CAC published the "Measures for the Standard Contract for the Export of Personal Information" ("Measures"), which, among other things, included the "Personal Information Export Standard Contract" ("Standard Contract") as well as a comprehensive and burdensome form for completing the TIA. The Measures imposed a November 30, 2023 deadline on multinational employers to execute the Standard Contract, complete the TIA, and file both with each relevant provincial office of the CAC ' depending on the location of each subsidiary in China.¹

In response to concerns expressed by the European business community and others over the complexity and burden of the process, particularly for transfers of HR data and BCI, in late September 2023, the CAC proposed the "Provisions on Regulating and Promoting Cross-border Data Flows" (draft for comments) ("Proposed Provisions"). The Proposed Provisions created several exceptions, including...