The following guest article was submitted by Mikheil Shengelia, Research Analyst at Eagle Alpha, an alternative data aggregation platform providing supporting advisory services for data buyers and vendors. Eagle Alpha hosts monthly legal webinars with expert guests to discuss various topics.
In China, Big Tech has grown rapidly without many regulatory hurdles in place to control their growth both within China and internationally. However, in the past few years the government began implementing harsh restrictions and rules around data dissemination and company growth on a global scale. Baidu, Alibaba, and Tencent, faced intense scrutiny, with penalties including IPO suspensions, substantial fines, and mandates to share algorithms with regulators.
This regulatory storm, which spanned over 32 months, significantly diminished the market value of major Chinese tech companies, a staggering decline in value exceeding 1 trillion USD. It wasn’t until a massive sell-off of Chinese stocks in March 2022 which prompted policymakers to reverse course and ease regulations.
Data Security Law and Cross-Border Transfers
China’s Data Security Law (DSL) was passed in June 2021 and came into effect on the 1st of September 2021. The DSL focuses primarily on the protection of overall national data security and sets out some high-level data management and protection methodologies and rules for government agencies, industry associations, enterprises, and other organizations. National security is a theme throughout the DSL. While the cybersecurity law only covers electronic information, this law outlines a framework to regulate the processing of all data (“any record of information in electronic or non-electronic format).
On March 22nd, 2024, the Cyberspace Administration of China (“CAC”) issued the Regulations on Promoting and Regulating Cross-border Data Transfers (the “New CBDT Regulations”). Key provisions include:
Data Export Exemptions. Specific scenarios exempt from data export procedures include:
- Data exports and transits related to international trade and cross-border transportation without personal information or important data.
- High-frequency cross-border activities like shopping, delivery, remittance, and payment.
- Transfers of employee personal information necessary for cross-border HR management.
Standards for Data Export Security Assessments:
- If personal data from over 1 million individuals or sensitive data from over 10,000 individuals is transferred abroad in a year, a data export security assessment is required.
- If data from 100,000 to 1 million individuals or sensitive data from under 10,000 individuals is transferred, a standard contract or certification is necessary.
Data Export Security Assessment of Important Data:
- The assessment depends on whether the data is listed as important by relevant departments or public notifications.
- If data is not publicly announced as important, reporting as important data is not necessary.
Our partners at Jun He Law Offices prepared a discussion bulletin explaining that data processors faced challenges when identifying important data due to the lack of publicly available catalogues from relevant departments or regions, complicating compliance with data export security assessments. To address this, regulations aim to reduce ambiguity, emphasizing the identification and reporting of important data to safeguard national security and public interests.
For example, the “Measures for the Security Management of Industrial and Information Systems Data (Trial)” require regular data reviews and the creation of specific catalogues. The newly released “Data Security Technology Data Classification and Grading Rules” (GB/T 43697-2024) provides guidelines for identifying important data, with Appendix G detailing factors for key industries.
Similarly, the Tianjin Free Trade Zone mandates enterprises to classify and grade data internally, submitting important data catalogues to the relevant authority. Enterprises are encouraged to review these regional and industry-specific catalogues to ensure compliance and secure the smooth cross-border transfer of data.
Network Data Security
More recently, the State Council introduced the Regulations on the Management of Network Data Securityon September 30th, 2024, effective January 1, 2025. The Regulations incorporate the Data Security Law (DSL), Personal Information Protection Law (PIPL), and cross-border data transfer provisions, setting conditions for cross- border personal information and important data transfers. Transfer conditions include:
- Conduct a security assessment for data export.
- Obtain personal information protection certification.
- Sign the standard contract for personal information export.
The framework aims to address critical issues and introduces rules for personal information handling, cross-border data transfer conditions, and obligations for network platform service providers. Businesses are advised to review and adjust their compliance measures in line with these new rules to avoid legal risks.
Key compliance requirements include updated provisions for personal information protection. Entities processing personal information of over 10 million individuals must now comply with important data processor standards, including appointing security officers and submitting risk assessment reports.
Overseas processors are required to establish and register designated representatives in China. The Regulations also refine privacy policy disclosures, mandate regular compliance audits, and specify conditions for personal information deletion and anonymization. These updates underscore the need for businesses to enhance their data governance practices and ensure transparency in handling personal data.
For cross-border data transfers, the Regulations introduce stringent conditions to align with existing laws and administrative measures. Network data processors must meet one of eight defined scenarios, such as obtaining personal information protection certification or conducting a security assessment. The framework emphasizes the importance of not exceeding the approved scope of data transfers and includes new security management requirements to mitigate risks. These measures aim to balance international data flows with national security considerations, creating a clear yet robust compliance roadmap for businesses.
Network platforms, especially major operators, face additional compliance obligations to address unfair practices and data security challenges. The Regulations hold platform operators accountable for preventing misuse of data advantages and ensuring fair competition. Specific requirements include transparency in data practices, preventing infringements on user rights, and ensuring equitable governance within their ecosystems. These measures reinforce the broader goal of safeguarding cyberspace and promoting secure and ethical data usage in China’s increasingly digitized economy.
The details of the first court ruling related to cross-border transfers made in September 2023 was recently disclosed to the public. The court ruled against an unnamed international hotel brand for mishandling personal information, marking the first judgment in China related to cross-border PI transfers. The case arose after a plaintiff discovered that their PI would be shared with unspecified overseas entities without clear consent. The court found the hotel brand violated the Personal Information Protection Law (PIPL) by failing to inform the plaintiff about data sharing and by transferring information for marketing purposes without proper consent.
Interestingly, the EU and China initiated discussions under the new Cross-Border Data Flow Communication Mechanism in August 2024, led by Sabine Weyand from the European Commission and Vice-Minister Wang Jingtao of China. The EU emphasized the importance of cross-border data flows for trade, particularly in sectors like finance, pharmaceuticals, and technology, and highlighted growing concerns among European businesses in China about stringent data export regulations.
Conclusion
In recent years, China’s regulatory landscape has undergone significant changes, particularly targeting the tech sector and data security practices. The strict measures from 2020 to early 2022 caused a sharp decline in market value, layoffs, and reduced hiring, prompting a policy reversal in 2023 to encourage growth and innovation.
The newly adopted Regulations on the Management of Network Data Security, effective January 2025, consolidates existing laws such as the DSL and PIPL. These regulations impose strict obligations on businesses, including appointing security officers, performing compliance audits, and meeting conditions for cross-border data transfers.
Overseas data processors must establish local representatives, and privacy policy disclosures must meet enhanced transparency standards. Major network platforms face additional scrutiny to prevent misuse of data and promote fair competition.
For more information on topics relating to alternative data sourcing and compliance and to learn more about how Eagle Alpha is assisting financial institutions with their alternative data strategy, please contact us.