On April 29, 2022, the Secretariat of National Information Security Standardization Technical Committee (TC260) released a notice to call for public comments on the draft of Implementation Guide of Cybersecurity Standards – Technical Specification for Cross-border Transmission of Personal Information (herein after referred to as “the Technical Specification”). The call-for-comment period ends on May 13. The Technical Specification contains 5 chapters with its main contents including:

I． Applicable scenarios and corresponding responsible parties

· For cross-border processing of personal information within a MNC or the same economic or business entity, the company it registered in China can apply for certification and bear legal liability.

· Overseas personal information processors that fit in the stipulation in Paragraph 2, Article 3 of the Personal Information Protection Law of the People's Republic of China may appoint specialized agencies or designated representatives in China to apply for certification. Such appointed agencies or representatives must bear legal liabilities for the transmission or processing of the personal information of Chinese natural persons abroad. 

The Technical Specification also obliges that the parties involved in information processing should sign relevant documents with standards no lower than those required by China's current laws and regulations, specifying: 1) the parties involved in cross-border information processing, especially institutions in China who would bear relevant legal responsibilities; 2) key information such as cross-border purpose and the category of personal information, and measures to protect the rights and interests of information subjects; 3) commitment to accept certification authority supervision, as well as the relevant personal information laws and regulations of China.   

II. Basic rules for cross-border transmission of personal information