The Personal Information Protection Law took effect on 1 November 2021. It applies to the handling of personal information of natural persons within Mainland China and, in some cases, to handling abroad that targets them. It requires a legal basis for each use, separate consent for sensitive personal information, and a personal information protection impact assessment for higher-risk processing, including any transfer outside the Mainland.
Cross-border transfer
Article 38 sets the routes for sending personal information abroad: a security assessment organised by the Cyberspace Administration of China, personal information protection certification by a professional body under CAC rules, a standard contract with the overseas recipient in the form the CAC prescribes, or another condition set by law or by the CAC. The Measures on the Standard Contract for Outbound Transfer of Personal Information took effect on 1 June 2023 and require the signed contract and impact assessment to be filed with the provincial cyberspace administration within ten working days of the contract taking effect. Article 39 requires the individual to be told who will receive the data, for what purpose and how to exercise their rights, and to give separate consent. For transfers to Hong Kong within the Greater Bay Area, the GBA Standard Contract offers a simpler form of the same route.
Why it matters
A Hong Kong firm that onboards a Mainland resident, or receives a Mainland company's filings that name its legal representative and shareholders, is receiving personal information from the Mainland. Without a filed route, the Mainland sender is in breach, and the Hong Kong recipient cannot show its auditor how the data arrived.
How Fill Easy relates to it
Fill Easy (Nansha) has filed a Standard Contract for cross-border personal information transfer (Filing No. 202500031), and clients receive Mainland data in Hong Kong under that filing through China Cross-Border Data. The individual's consent is captured in the check, and the client files nothing of its own. Our page on PIPL and the GBA Standard Contract sets out the detail.