Do the CAC’s Provisions on Promoting and Regulating Cross-border Data Flows relieve SMEs from China’s strict data-protection regime?

Abstract

The Cyberspace Administration of China’s Provisions on Promoting and Regulating Cross-border Data Flows (the “CAC Provisions”) contain long-awaited exceptions for the cross-border transfer of personal data out of China. This article summarizes the CAC Provisions, explains their practical implications for SMEs in China, and highlights the conditions under which SMEs can make use of the exceptions in the CAC Provisions to effect outbound data transfers. It also compares the final CAC Provisions with the draft of September 28, 2023, showing which of the issues left unresolved in the draft are addressed in the final version of the Provisions. Finally, the article discusses and provides recommendations on the challenges SMEs face in complying with the legal requirements.