On Tuesday, 30 May 2023, the Cyberspace Administration of China (CAC) released the "Guide to the Filing of the Standard Contract for Outbound Transfer of Personal Information (First Edition)" ("Filing Guide"), providing detailed guidance on how exporters of personal information should file Standard Contracts (SCs) with the CAC, including:
- Clarifying which legal documents are required in additional to SC and the data protection impact assessment report (PIA).
- Procedure for the filing: the CAC will examine the filing and notify the data exporter within 15 working days from receipt of the file. If not approved, the data exporter must supplement and resubmit within 10 working days.
The Filing Guide also provides a template for the PIA. The PIA template has quite a lot of similarities to the template for the government-led security assessment report, and requires data exporters to provide detailed information with respect to data flows, system platforms, data centers and data protection measures of both the data exporter and the overseas recipients of the private information.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.