China's internet regulator published guidance on 11 September on when companies can send personal data abroad by getting it certified, rather than through a government security assessment [1].
Companies that are not critical-infrastructure operators can use certification if, since 1 January, they have sent abroad personal data on 100,000 to under 1 million people [1].
The same applies if they have sent sensitive data on fewer than 10,000 people, provided no "important data" is involved [1].
Above those levels, 1 million people or 10,000 for sensitive data, they must apply for a security assessment through the regulator [1].
What it covers
Companies handling personal information in China that transfer it abroad. Any such company may also seek certification voluntarily, whatever the volume, to show its practices meet national standards [1].
The regulator says companies may not split transfers into smaller amounts to use certification when the law requires an assessment [1].
A company that later crosses the threshold can attach its certification results to its assessment application, which the regulator will take into account [1].
What it does not tell you
How many companies have been certified, or refused. The guidance gives rules, not figures [1].
It clarifies existing rules rather than creating new ones, in answer to questions the regulator received [1].
Comments