Data privacy

China
The Regulations on Employment Services and Employment Management require that an employee's personal data is kept confidential and not made public without the employee's consent.
The PRC Cyber Security Law imposes new security and data protection obligations on "network operators," puts restrictions on transfers of data outside China by "key information infrastructure operators" and introduces new restrictions on critical network and cybersecurity products.
The Civil Code strengthens protection on individuals’ privacy and personal information. It improves the legal definition of personal information and clarifies the connotation, principles and conditions of handling personal information as well as strengthens the information security obligations of processors.
The Personal Information Protection Law (PIPL) came into effect on November 1, 2021, setting out the first comprehensive legal regime regulating the protection of personal information in China. There are requirements on notification and obtaining separate consent when collecting, processing and transferring personal information. Additional legal grounds for processing personal information in addition to the general “consent-based” approach are included in the PIPL.
China continues to promote legislation related to personal information protection. On September 1, 2022, the Measures for the Security Assessment of Outbound Data Transfers (the Measures) came into effect, setting forth requirements for outbound data transfer. According to the measures, organizations may transfer or access most personal data outside of Mainland China if required conditions and procedures have been fulfilled, while certain data must nonetheless stay in Mainland China unless special sectoral approvals are obtained.
In February 2023, the Cyberspace Administration of China (CAC) released the Measures for the Standard Contract for Cross-Border Transfer of Personal Information (Measures), which has been effective since June 1, 2023. The Measure requires employers who adopt the China standard contractual clauses (SCC) route for cross-border transfers of China personal data to file their signed China SCCs together with the supporting personal information impact assessment report with their local CAC branch by no later than November 30, 2023. However, on September 28, 2023, the CAC released a Draft Provisions on Regulating and Promoting Cross-border Data Flows, which proposed that employee data, necessary for HR management, may be exempt from the cross-border data transfer burdens.