The Data Transfer Requirements under CSL and GDPR
Article 37 of CSL initially requires that operators of critical information infrastructure (CII) store personal information and important data collected or generated in China within the territory of China, and conduct a security assessment if such data needs to be provided to a foreign party. Article 2 of the draft Measures later issued by the Cyberspace Administration of China (CAC) expanded the assessment requirement from CII operators to “network operators.”
CII operators refer to companies in critical sectors such as radio, television, energy, transportation, water conservancy, finance, and others that “will result in serious damage to state security, the national economy and the people’s livelihood and public interest if it is destroyed, loses function or encounters data leakage.” The much broader category, “network operators,” refers to “owners, operators, and service providers of computer networks.”
Download the PDF below to learn more!