CHINA Law and Practice Contributed by: Jihong Chen, Zhong Lun Law Firm
ing the data privacy practices concerning their global business operations. 4.4 Transfer of Personal Data in Asset Deals All forms of data or PI processing activities occurring in asset deals shall be governed by the DSL and the PIPL. The requirements and obligations set forth under the DSL and the PIPL for data and PI processing shall be com - plied with accordingly. Specifically, with regard to any transfer of PI due to merger, division, dis - solution or declaration of bankruptcy, etc, Arti - cle 22 of the PIPL specifies additional disclosure requirements that relevant data subjects shall be informed of the name and contact information of the PI recipient. In the event of any changes to the original purpose and method of data pro - cessing by the PI recipient, consents from the concerned data subjects shall be re-obtained. 5. International Considerations 5.1 Restrictions on International Data Transfers According to the CSL, PI collected by CII - Os during their operations in China must be stored within Chinese territory. Where there is a need to transfer such information overseas, a security assessment shall be conducted. The PIPL expands the applicable scope of security assessment. A suitable CBDT mechanism shall be implemented before PI can be transferred overseas. So far, the importing of data from overseas to China has not been the focus of the administration. The PIPL provides three routes for CBDT com - pliance:
• obtaining approval for CAC security assess - ment; • being certified by the recognised agencies; or • concluding standard contractual clauses with the overseas recipient. According to the Measures for the Security Assessment of Data Cross-Border Transfer (“Outbound Measures”; 数据出境安全评估办法 ), the security assessment mainly covers the legality, legitimacy and necessity of the purpose, scope and method of the outbound transfer of data. It also includes: • an impact analysis of the policies and regu - lations on data security and the network security environment of the country or region where the overseas recipient is located; • the data protection level of the overseas recipient; • the quantity, scope, type and sensitivity of the data; • risk of leakage, tampering, loss, damage, etc; • protection of data security and the rights and interests of PI subjects; and • legal documents between the data handler and the overseas recipient, etc. The certification mechanism mentioned in the PIPL is finalised by the Technical Specification for Certification of Cross-Border Transfers of Personal Information V2.0 ( 网络安全标准实践指南 – 个 人信息跨境处理活动安全认证规范 V2.0). The Measures for Certification of Personal Information Protec - tion for Outbound Transfer of Personal Informa - tion (Exposure Draft) ( 个人信息出境个人信息保护认证 办法 ( 征求意见稿 )) were released on 3 January 2025, further regulating the certification of mecha - nisms for the outbound transfer of PI. As for standard contractual clauses, the Meas - ures for the Standard Contracts for Outbound
85
CHAMBERS.COM
Powered by FlippingBook