China to implement strict new cross-border data transfer rules from September, complicating operations of international firms

  • Under the new rules, a security review is mandatory for a firm that handles the personal information of more than 1 million Chinese residents
  • The Cyberspace Administration of China has the discretion to conduct a security review indefinitely

China’s latest cross-border information regulation does not specify whether data flows between the mainland and Hong Kong will also be subject to security reviews. Illustration: Shutterstock
China will implement from September its strict new cross-border data transfer regulation, which is expected to complicate and significantly raise compliance costs for the operations of many international businesses in the country.
The finalised regulation, published by internet watchdog the Cyberspace Administration of China (CAC) on Thursday, will require “important” and massive data transfers from China to destinations outside its borders to be subject to security review. The CAC has the discretion to conduct a review indefinitely.
Print option is available for subscribers only.
SUBSCRIBE NOW
Copyright © 2025 South China Morning Post Publishers Ltd. All rights reserved.