Update on New Regulations for Data Transfer in China

This newsletter serves as an update on the new regulations concerning the transfer of personal information outside of China, specifically in relation to the PRC Personal Information Protection Law (PIPL). It outlines the prerequisites that personal information handlers must fulfill to legally transfer data, including self-assessments, obtaining certifications, and signing standard contracts with overseas recipients. The newsletter highlights the recent regulation issued by the Cyberspace Administration of China, effective March 22, 2024, which introduces exemptions for certain data transfers, particularly those related to HR management. Key takeaways for multinational companies include the necessity of obtaining explicit consent from employees, minimizing data collection, conducting security assessments, and maintaining accountability in personal information protection. The document emphasizes the importance of compliance with evolving legal requirements and the need for continuous updates to data protection policies. Overall, it underscores the balance between regulatory compliance and effective personal information management.