what we think

On Tuesday, 30 May 2023, the Cyberspace Administration of China (CAC) released the "Guide to the Filing of the Standard Contract for Outbound Transfer of Personal Information (First Edition)" ("Filing Guide"), providing detailed guidance on how exporters of personal information should file Standard Contracts (SCs) with the CAC, including:

• Clarifying which legal documents are required in additional to SC and the data protection impact assessment report (PIA). 
• Procedure for the filing: the CAC will examine the filing and notify the data exporter within 15 working days from receipt of the file. If not approved, the data exporter must supplement and resubmit within 10 working days.

The Filing Guide also provides a template for the PIA. The PIA template has quite a lot of similarities to the template for the government-led security assessment report, and requires data exporters to provide detailed information with respect to data flows, system platforms, data centers and data protection measures of both the data exporter and the overseas recipients of the private information.

R&P’s data privacy team advises companies on how to remain compliant with China’s data privacy laws, and supports our clients with assessments and CAC filings. For more information on how we can support your business to be compliant, please reach out to [email protected] or [email protected], or to your usual contact at R&P.