10 ways China’s new data rules will change your business

Who’s affected: The law’s global reach

If your company processes any personal data from China to provide a product or service to Chinese residents or to analyze their behavior, you will likely have to comply with PIPL’s rules — even if you have no business presence in China. For PIPL, “personal information” is any information related to an identified or identifiable person. It does not include anonymized data. A “personal information processor” as defined by the law is any individual or organization with the discretion to determine the purpose and method of data processing.

10 key requirements to address now

Controlling data throughout its entire life cycle is no longer just an industry leading practice — in China it’s the new minimum baseline. When you take the new rules in the context of the existing China Cybersecurity Law (CSL), Data Security Law (DSL) and PIPL, a clear picture emerges of ten high-impact changes for non-Chinese multinationals. 

1. Dynamic data inventory. 

China requires classification of data into general, important and core categories. Multinationals with a significant presence in China will need to enhance their record of processing activities with new required fields and automate as much of this process as is feasible with data discovery, classification and workflow technologies. 

2. Data localization.

Companies that meet the criteria under CSL for critical information infrastructure operator (CIIO) or process large volumes of Chinese personal data are subject to data localization requirements in China. The new rules bring the reach of these requirements to foreign companies outside China if they process data for providing goods or services to China, analyze behaviors of individuals in China or process important data. 

3. Local governance staff. 

Recent legislation sets out extra requirements on appointing data responsible persons. If your company processes Chinese resident data but lacks a business presence in the country, you’ll have to either create a special agency or appoint representatives in China to be in charge of your compliance. This provision adds China to the list of about 70 territories tracked by PwC’s Ready Assess database that require local data protection officers.

4. Multilevel barriers to cross-border data transfers.

To transfer Chinese resident data abroad, you’ll generally need to follow a series of steps including obtaining consent; registering the transfer with the government or completing an assessment certified by a third party; implementing technical security measures to prevent foreign-government access to the data; and tracking onward transfer to other entities.

Multinationals currently enhancing their data-transfer controls for EU General Data Protection Regulation (GDPR) and Schrems II readiness will need to apply a similar but augmented approach to their Chinese data transfers and extend their SOC 2 assurance capabilities to this scope.

5. Multiple mandatory assessments.

China’s data privacy and security laws require risk and impact assessments across a broad array of use cases. Companies that automate their data privacy and protection impact assessments for the Americas and EMEA now have a driver to extend this capability to the Asia-Pacific region.  

6. Consent management for sensitive personal information.

If you process data designated as “sensitive personal information,” you’ll have to seek separate consent from these individuals or their guardians, state why you’re processing this data and explain the impact.

China’s rules amplify the impact on consumer-facing companies of similar consent requirements in Europe and the United States at the same time that technology platforms are restricting the use of tracking mechanisms such as cookies, putting a premium on permission-based consumer relationships. 

7. Accelerated incident response.

Data processors must notify multiple business and government stakeholders as well as affected individuals about the incidents, risk of data breaches and remedial actions they’ve taken within three working days. If the incident involves important data or personal data on more than 100,000 people, companies must report the breach to the appropriate regulators within eight hours.

This timeline is among the most stringent globally and will require state-of-the-art detection, response and resilience capabilities typically seen only in advanced financial and technology companies.

8. Consent for automated decision-making.

Many companies from retail to insurance are striving to address their talent shortage by applying artificial intelligence and machine learning to robotic process automation. If your company uses Chinese personal data for automated decision-making about individuals, you may need to provide transparent explanations about how you’re making decisions about them and enable them to reject the automation and ask for a manual review. 

9. Transparency reports for platforms.

If you operate a large digital platform, you may have to enforce fair, transparent and impartial data-processing rules for the product and service providers who use it. You’ll also need to publish social-responsibility reports on data handling, establish a personal information protection compliance system, and create an independent, external body to supervise personal information protection. 

10. Third line of defense for privacy.

The internal audit departments that constitute the third line of defense in organizational systems of control historically have not maintained data privacy talent in many companies. Instead, they often turn to their own privacy offices or external audit firms for consultation and support. The new rules in China don’t explicitly require internal audit privacy expertise. If PIPL applies to your company, however, data privacy is likely to join cybersecurity as a top risk and it will require ongoing monitoring and control.