CAC relaxes data export rules
File this one under “promises kept.”
On Friday, the cyberspace regulator (CAC) eased restrictions on exporting personal information and other sensitive data.
Some context: CAC introduced a problematic data export approval system in July 2022.
- Lack of clarity on key definitions and a low threshold for mandatory assessments infuriated the business community and political leaders.
New rules released by CAC reduce the compliance burden in three big ways.
First, it greatly narrows the scope of data subject to assessment.
- The amount of personal data that can be exported without triggering an assessment has increased from 100,000 people to 1 million.
- Certain activities are exempt altogether, including HR operations, remittances, e-commerce, and travel ticketing.
Second, data isn't considered “important” – and thus subject to tighter export rules – unless explicitly designated.
- This ends the compliance guessing game over which data CAC considers "important."
Finally, data export security assessments will be valid for three years, up from two.
- It will also be easier to extend security assessments upon expiration.
It will likely get even better: Free-Trade Zones will have special authority to pilot further relaxations.
Get smart: The new rules substantially reduce the compliance burdens for foreign companies wanting to export data.
Get smarter: Companies must closely watch how "important data" is being defined in their industries, and try to work with regulators to ensure these definitions don’t become too restrictive.
Hungry for more? Trivium Tech subscribers can read our full analysis of the new rules here.