As multinational companies wrap up compliance preps for the EU's General Data Protection Regulation (GDPR), China's Cybersecurity Law (CSL) takes center stage presenting new challenges. Although CSL took effect on June 1, 2017, the compliance deadline for the most controversial cross-border data transfer requirement is deferred until Dec. 31, 2018. Companies deemed “network operators” are required to conduct a security assessment if they transfer personal information or important data collected or generated in China to a foreign party. While CSL's security assessment regime remains under development and the draft bears superficial resemblance to GDPR, the Chinese legislative and enforcement styles create confusion, and sometimes false hopes, for western companies. This article sheds light for in-house counsel with GDPR exposure on how to prepare for CSL's data transfer requirement.

The Data Transfer Requirements under CSL and GDPR

Article 37 of CSL initially requires that operators of critical information infrastructure (CII) store personal information and important data collected or generated in China within the territory of China, and conduct a security assessment if such data needs to be provided to a foreign party. Article 2 of the draft Measures later issued by the Cyberspace Administration of China (CAC) expanded the assessment requirement from CII operators to “network operators.”