Here is the article converted to Markdown format with proper headings, subheadings, and bullet points:
Human Resources Management: A Critical Aspect of Compliance in China’s Data Protection Regime
As China continues to strengthen its data protection regulations, companies operating in the country must ensure they are fully compliant with the requirements set out by the Personal Information Protection Law (PIPL). One key area of focus is human resources management, particularly when it comes to the transfer of personal information (PI) across borders.
Compliance Audit Requirements
To facilitate compliance, the Chinese government has introduced a series of regulations governing the cross-border transfer of PI. These requirements are summarized in the table below:
| Audit Focus | Corresponding Legal Requirement | Relevant Legislation |
|---|---|---|
| 1. Security Assessment | Companies must undergo a security assessment by the Cybersecurity Administration of China (CAC) if they wish to export data if they are CIIOs and data processors that process PI of more than one million people providing PI overseas. | Article 38 of the PIPL, Article 4 Item 2 of the Measures for Data Export Security Assessment |
| 2. Security Assessment | Companies must undergo a security assessment by the CAC if they wish to export data if they are data processors that have transferred the PI of over 100,000 people or the “sensitive” PI of over 10,000 people overseas since January 1 of the previous year. | Article 38 of the PIPL, Article 4 Item 3 of the Measures for Data Export Security Assessment |
| 3. Judicial and Law Enforcement Requests | Without approval from the competent Chinese authority, PI processors shall not provide PI stored within China to judicial or law enforcement agencies outside China’s territory. | Article 41 of the PIPL |
| 4. International Treaties and Agreements | The competent Chinese authority shall handle requests from foreign judicial or law enforcement agencies for the provision of PI in accordance with international treaties and agreements. | Article 42 of the PIPL |
| 5. PI Protection Impact Assessment | Companies must conduct a PI protection impact assessment if they provide PI to overseas parties. | Article 55 Item 4 of the PIPL, Article 5 Item 5 of the Measures for Standard Contracts for Exporting Personal Information Overseas |
| 6. Restriction and Prohibition List | The CAC may add overseas organizations or individuals who have engaged in PI processing activities that damage the rights and interests of Chinese citizens or endanger China’s national security or public interests to a list of entities that are restricted or prohibited from receiving PI. | Article 42 of the PIPL |
Implications for Foreign Companies
The requirements for regular compliance audits, if passed into law in their current form, will add an additional compliance burden for foreign companies operating in China. However, most companies operating in China have already begun to implement processes to comply with these regulations.
- Transparency and cooperation with auditors will be key to ensuring smooth auditing procedures.
- Companies that have not implemented procedures to comply with current PI protection laws are advised to take steps to rectify any potential oversights or violations as soon as possible. Failure to do so may result in severe penalties, including fines and even criminal liability.
About the Author
This article was written by Dezan Shira & Associates, a leading foreign direct investment advisory firm in China. The company has been assisting foreign investors into China since 1992 through offices in Beijing, Tianjin, Dalian, Qingdao, Shanghai, Hangzhou, Ningbo, Suzhou, Guangzhou, Dongguan, Zhongshan, Shenzhen, and Hong Kong.
Contact the author at china@dezshira.com or visit their website at www.dezshira.com. Dezan Shira & Associates has offices in Vietnam, Indonesia, Singapore, United States, Germany, Italy, India, Dubai (UAE), and Russia, in addition to our trade research facilities along the Belt and Road Initiative. We also have partner firms assisting foreign investors in The Philippines, Malaysia, Thailand, Bangladesh.
About China Briefing
China Briefing is a leading source of news and analysis on business and economic trends in China. Our team of experts provides insights into the complexities of doing business in China, as well as practical advice for foreign companies seeking to enter or expand their operations in the Chinese market. Visit our website at www.china-briefing.com for more information.