As the Cyberspace Administration of China and sector-specific regulators articulate standards for cross-border data transfer and define data types, companies with diverse operations may face conflicting compliance requirements.

Free flow of data across borders is an essential part of customer outreach, product maintenance, personnel management, and much more. Chinese regulators are working to articulate both cross-industry and industry-specific guidance for cross-border data transfer, particularly by defining “important data,” which is subject to tighter restrictions.

In October 2021, the Cyberspace Administration of China (CAC) issued the Outbound Data Security Assessment Measures (hereinafter referred to as “Outbound Measures”), which implement aspects of the Data Security Law and the Personal Information Protection Law by requiring important data and personal information collected in China to undergo a security assessment prior to a cross-border transfer. Then, in February of this year, the Ministry of Industry and Information Technology (MIIT) released the second draft of its Data Security Administrative Measures for the Industry and Information Technology (IT) Sector, which dictate how businesses in the telecommunications, manufacturing, and broadcasting industries must approach applying for cross-border data transfer reviews, and what data will be subject to said reviews. 

MIIT’s draft administrative measures provide an early indicator of how sector-specific regulators may choose to approach developing standards for companies in their purview. Other industry regulators, including automotive, healthcare, and finance, have also worked to articulate standards within their sector. The flurry of sectoral activity raises the possibility that sectoral standards will conflict with CAC standards or across sectors, creating challenges for businesses with diverse product offerings.

01 MIIT regulatory structure