Cybersecurity

• Secretariat of the National Information Security Standardization Technical Committee, Information Security Technology — Security Requirements for Processing of Key Data (Draft for Comments)

  全国信息安全标准化技术委员会秘书处信息安全技术 重要数据处理安全要求（征求意见稿）

  Instructions are laid out for overseas transfer of key data

  October 13, 2023

• Beijing Municipality, Foreign Investment Regulations (Draft for Comments)

  北京市外商投资条例 (草案征求意见稿)

  Beijing promotes free flow of ordinary data for foreign-invested enterprises

  October 13, 2023

• In the News: Data Transfer Rules Loosened; Kyndryl Splits China Business; and Shenzhen Finances Tech Companies

  China proposes to allow businesses to transfer certain types of data overseas without restrictions; IBM's former IT services arm Kyndryl plans to split its China business over data security rules and tech restrictions; and Shenzhen's government introduces initiatives to raise funding for local tech companies amidst U.S. tech restrictions

  October 11, 2023

  

• National Information Security Standardization Technical Committee, Practice Guidelines for Cybersecurity Standards—Methods for Labeling Generative Artificial Intelligence Service Content

  全国信息安全标准化技术委员会秘书处网络安全标准实践指南——生成式人工智能服务内容标识方法

  Practice guidelines are issued specifying labeling of AI content

  September 28, 2023

• Secretariat of the National Information Security Standardization Technical Committee, Information Security Technology—Security Requirements for Processing of Sensitive Personal Information (Draft for Comments)

  全国信息安全标准化技术委员会秘书处信息安全技术 敏感个人信息处理安全要求 (征求意见稿）

  Processing of sensitive personal information may require written consent of the individual

  September 28, 2023

• In the News: China Enforces Cybersecurity Rules; Gotion Invests in EV Battery Facility in the U.S.; and Former SEC Chair Urges Disclosure on China Exposure

  China's cybersecurity laws are heavily enforced for businesses of all sizes; Chinese Gotion receives CFIUS approval to build an EV battery facility in Illinois; and Former SEC Chair proposes large public companies disclose their exposure to China

  September 14, 2023

  

• Secretariat of the National Information Security Standardization Technical Committee, Information Security Technology — Security Requirements for Automated Decision Making Based on Personal Information (Draft for Comments)

  全国信息安全标准化技术委员会秘书处信息安全技术 基于个人信息的自动化决策安全要求 (征求意见稿)

  Guidelines are given for informing individuals of automated decision processing of their personal information

  September 05, 2023

• Cyberspace Administration of China, Key Reference Points for Compliance Audits of the Protection of Personal Information (Draft for Comments)

  国家互联网信息办公室个人信息保护合规审计参考要点 (征求意见稿)

  Lawfulness of personal information processing is the focus of an compliance audit.

  September 05, 2023

• In the News: Data Security Law Reform?; China Securities IPOs; and US Import Scrutiny Heightened

  China meets executives of international firms in order to reassure them over data security regulations; CSRC seeks regulatory opinion for the frist time for overseas listing; and Chinese automobile parts included in U.S. import detention over Xinjiang concerns

  August 23, 2023

  

• China Issues Significant New Draft Rules Relating to Personal Information Protection Compliance Audits

  New draft measures on personal information protection compliance audits have been released for public comment. Jianwei (Jerry) Fang and Chuchen (Julie) Hou of Zhong Lun Law Firm analyze the legislative basis and specific requirements of the new draft, and provide some practical recommendations for PI processors who are planning for an upcoming compliance audit.

  August 22, 2023