China has established the compliance framework for cross-border data transfer since China’s Personal Information Protection Law (《中华人民共和国个人信息保护法》) (the “PIPL”) came into effect on November 1, 2021. Based on the sensitivity/importance and the volume of the personal information (“PI”) they process, businesses are expected to conduct at least one of the following before they can lawfully transfer PI out of mainland China: (i) obtain security assessment approval for exporting the PI; (ii) conduct and obtain PI protection certification; or (iii) enter into a standard contract for cross-border transfer of PI (the “SCC”) with the overseas recipient (collectively, the “PI Export Compliance Methods”).
On February 22, 2023, the CAC released the Measures for the Standard Contract for Outbound Cross-Border Transfer of Personal Information (《个人信息出境标准合同办法》) (the “SCC Measures”). For multi-national companies (“MNCs”) that process PI in low volume with no important data (as determined by relevant authorities), signing the SCC form and having it filed with the Cyberspace Administration of China (the “CAC”) is the most commonly followed compliance method. Parties to the SCC need to sign the form as is with little deviation in order to satisfy the CAC requirements.
Hong Kong’s data protection regime for personal information is governed by the Personal Data (Privacy) Ordinance (Cap. 486) (the “PDPO”), and its regulator is the Office of the Privacy Commissioner for Personal Data (the “PCPD”). The PDPO establishes data subject rights, specific obligations to data controllers, and regulates the collection, processing, possessing, and use of PI through six data protection principles. It requires a data user to take all practicable steps to ensure that any PI held by the data user is protected against unauthorized or accidental access, processing, erasure, loss or use. Hong Kong currently does not require government filings before transferring data cross-border.
