Transferring data out of China? Understand the key points from the Chinese Standard Contractual Clauses

The Cyberspace Administration of China (CAC) released the long-awaited Chinese Standard Contractual Clauses (SCCs) on 24 February 2023. This will significantly impact any business that transfers employee and customer data – and other personal information – out of China.  

The SCCs are a template contract to help data controllers/processors transfer relatively ‘small’ quantities of data, including personal data of <100,000 individuals or sensitive personal data of <10,000 individuals since the previous civil year.

Data exporters who exceed the above thresholds, have processed personal data of totally more than 1 million individuals in mainland China and/or are considered critical information infrastructure operator (CIIO) must follow other rules, including robust data transfer agreements, stricter security assessments and more detailed reports to Chinese authorities.

The Chinese SCCs share a few similarities with the European Union’s SCCs, but also include many different specificities (same template for data controllers and data processors alike, prior impact assessment, filing with local authorities, Chinese law as governing law, etc).

Data exporters have until 30th November 2023 to regularise their international transfer of personal data related to individuals in mainland China.

Companies are advised to check their eligibility for using the Chinese SCCs, examine the implication back in their home jurisdiction, conduct a protection impact assessment and file reports to the Chinese authority, before transferring personal data out of mainland China.

For more information or guidance on the Chinese Standard Contractual Clauses, contact Vivian Desmonds.