Unlocking Opportunities: China’s Move to Ease Cross-Border Data Security Controls

Receive free Cyber Security updates

We’ll send you a myFT Daily Digest email rounding up the latest Cyber Security news every morning.

China has eased its strict regulations on cross-border data transfers in response to complaints from foreign businesses and the weakening economy.

The Cyberspace Administration of China (CAC) introduced new rules aimed at simplifying the process of transferring data out of the country for everyday business operations.

This move by Beijing is an attempt to address concerns from foreign businesses regarding the deteriorating US-China relations and the growing influence of China’s security apparatus.

Under the previous security rules, CAC reviewed numerous data export submissions from foreign organizations looking to share “important data” abroad.

However, these rules created confusion and uncertainty, with people unsure whether to apply for data reviews or what qualified as important data, according to China expert Graham Webster from Stanford University’s Center for International Security and Cooperation.

Webster stated, “These changes will provide a clearer pathway for most data to be sent abroad.”

CAC’s new draft rules specify that only data explicitly categorized as important by government agencies will require a security review. The draft rules also allow global companies to share employee records outside China and permit the transfer of personal information for cross-border purchases or reservations without security reviews.

China’s strict controls and the implementation of an expanded anti-espionage law led many foreign organizations to separate their local IT systems and data. In an attempt to avoid inadvertently transferring sensitive material, several companies chose to fully localize their data.

CAC’s draft rules are open for public comment until mid-October. It remains unclear whether these changes will be sufficient to ease concerns among foreign companies.

An expanded anti-espionage law remains in effect, and the Ministry of State Security has adopted a “whole of society” approach to addressing security risks, encouraging all citizens to join the fight against espionage and intensifying domestic propaganda efforts.

This year, state security officials have conducted raids on the offices of US consultancies like Bain & Company and Mintz Group. They have also aired a primetime broadcast of police searching the offices of Capvision, an expert network group that assisted foreign investors with due diligence. Micron Technology’s chips, a US semiconductor giant, have been labeled “serious network security risks” and prohibited in infrastructure.

Webster commented, “Security remains a major concern for Xi Jinping’s China. They have been sending mixed signals regarding data gathering and transferring.”