China says new data export rules take effect in September

China’s cyberspace regulator said on Thursday that new rules requiring security assessment before data export by companies in the country will come into effect from September 1.

Details of the new mandatory security review to be carried out by the Cyberspace Administration of China (CAC) were finalized and published on Thursday (7), the regulator said in a statement on its official WeChat account.

The assessment will be used to determine whether large amounts of Chinese user data held by a private entity can be sent abroad.

While many of the implications of the new rules have already been laid out by the CAC in previously published minutes, Thursday’s final version adds an important detail.

Companies or entities that since January 1 of last year have sent abroad personal information of at least 100,000 users, or “sensitive” personal information of at least 10,000 users, will also have to undergo CAC’s security review.

Previously, it was not known from which date the regulator would measure the size of user data collections of companies and entities.

The January 1 date confirms that the scope of the security review will go far beyond just “critical information infrastructure operators and data processors who handle the personal information of more than 1 million people,” another category defined in advance by the rules. published by the CAC.

“Clarifying the specific provisions of the data export security review is necessary to promote the healthy development of the digital economy, prevent and address cross-border data security risks, and safeguard national security and the social and public interest,” the CAC said in this statement. Thursday.

CAC released cybersecurity assessments on Chinese companies Full Truck Alliance, Kanzhun and giant Didi Global in July last year, ordering them to stop registering new users, citing national security and the public interest.

While Full Truck Alliance and Kanzhun announced the resumption of new user registration last week and said they had “rectified” the issues identified by the CAC investigation, Didi has yet to make a similar announcement.