On April 29, 2022, the National Information Security Standardization Technical Committee of China issued a draft version of the Cybersecurity Standard Practice Guidelines – Technical Specification on Certification of Personal Information Cross-border Transfer Activities (the “Guidelines”). The public comment period for the Guidelines closed May 13, 2022. The Guidelines establish the basic requirements for personal information protection certifications, which are one of four cross-border transfer mechanisms permitted under Article 38 of China’s Personal Information Protection Law (“PIPL”).

Certifications for personal information cross-border processing are voluntary, as there are other means by which cross-border processing can occur. However, the Chinese government nonetheless recommends that parties seek certification by qualified entities, which will be named at a later date. The key provisions of the Guidelines are listed below. 

Application of the Guidelines

The Guidelines will only be applicable to two types of cross-border transfers: (1) internal cross-border transfers within one multinational company or one economic/business entity; and (2) cross-border transfers by non-Chinese entities that analyze and assess the behavior of the individuals located in China subject to the extra-territorial jurisdiction of the PIPL.

In cases of internal transfers, the Chinese entity of the multinational company or economic/business entity may apply for the certification and will be liable for the relevant cross-border transfer activities. In cases of extra-territorial jurisdiction of the PIPL, the domestic institution or the representative of the foreign entity may submit the application for certification and will be liable for the relevant cross-border transfer activities.

Basic Requirements for Certification

The Guidelines set forth several areas that must be addressed in the certification, including but not limited to: (1) legally binding agreements between the parties involved; (2) management of personal information protection within the parties’ organizations; (3) personal information protection impact assessments (“PIPIAs”); and (4) rights of the data subjects.

1. Legally Binding Agreements Between the Parties Involved

The parties involved in the cross-border transfer must execute a legally binding and enforceable contract that, among other things:

• describes the parties involved in the cross-border transfer (the “Parties”);

• describes the purposes of cross-border transfer and the types and scope of personal information to be transferred;

• describes the safeguards for protection of rights of data subjects;

• requires the Parties to comply with the uniform personal information processing rules and specifies that the level of personal information protection shall not be lower than that stipulated by Chinese law with respect of personal information protection;

• requires the Parties to accept the supervision of the certification institution;

• requires the Parties to abide Chinese personal information protection laws; and

• requires the Parties to explicitly appoint a Chinese entity, which shall be responsible for the cross-border transfer activities.

2. Management of Personal Information Protection Within the Parties’ Organizations

The Guidelines require that the Parties designate Personal Information Protection Officer.

The Parties must designate a data protection officer who must have sufficient knowledge of personal information protection requirements and appropriate work experience. The Guidelines suggest, but do not require, that this officer be a senior management-level employee within the organization.

The Parties must also set up a personal information protection department, which will be responsible for:

• promulgating and implementing the cross-border transfer plan recognized by the Parties;

• organizing the PIPIA;

• supervising the personal information processing in according with personal information processing rules; and

• receiving and handling the complaints and requests of data subjects.

The Guidelines also require the Parties to implement and comply with cross-border personal information transfer and processing policies. These policies must contain:

• information regarding the processing, including the types of personal information transferred or processed, the degree of sensitivity and the volume of personal information transferred;

• the purpose, means and scope of cross-border transfer;

• the starting time and ending time for personal information storage and how to process personal information after the expiration of the storage period;

• the country/region where personal information will be transferred;

• the resources required for safeguarding the rights of the data subjects and relevant measures to be taken by the party; and

• the compensation and handling procedures with respect to data incidents.

3. PIPIAs

The Parties must conduct a PIPIA, which must at least address:

• whether the cross-border transfer complies with Chinese laws and regulations;

• the impact of cross-border transfer on the interests of the data subjects;

• the impact of legal environment of the foreign country/region and cybersecurity environment on the interests of data subjects; and

• other matters for safeguarding the personal information interests.

4. Rights of Data Subjects

The Guidelines require the Parties to obtain the individual’s informed separate consent to the cross-border transfer of their personal information, in addition to obtaining certification of the cross-border transfer. Individuals must be notified by email, SMS, mail or fax about: (1) the overseas personal information processor’s identity; (2) the categories of personal information transferred; (3) the purpose for transferring the personal information; and (4) the retention period for the personal information. Parties must provide these data subject with access to their personal information and ensure that data subjects can exercise their rights to access, copy, correct, supplement or delete their personal information as provided for under the PIPL.

This draft of the Guidelines provides a relatively flexible certification mechanism for personal information protection in China with respect to the cross-border transfer of personal information. It is expected to see a more detailed and practical implementation rule on a specific certification procedure as well as qualified certification institutions in the final version of the Guidelines or other relevant implementing rules.