At present, with economic globalization, the proportion of multinational corporations in the global market is gradually increasing. For the purpose of business operations and management, multinational corporations need to frequently transfer employee information, customer information and other data generated by their establishments in various countries to the headquarters across borders, which creates the demand for compliance with cross-border provision of personal information. At the same time, with the introduction of relevant regulations such as the "Personal Information Protection Law" in China, increasingly stringent compliance requirements have been put forward for data processing activities such as cross-border provision of personal information as mentioned above. Therefore, this article has compiled the relevant regulations on cross-border provision of personal information by multinational corporations. The table below sets forth some of the laws and regulations involved in cross-border provision of personal information, as well as the draft regulations published by the authorities:

1. The Scope of Application of Laws and Regulations such as the

Article 3 of the Personal Information Protection Law

Activities concerning the processing of personal information of natural persons within the territory of the People's Republic of China shall be governed by this Law.

Activities concerning the processing of personal information of natural persons within the People's Republic of China that occur outside the territory of the People's Republic of China shall also be governed by this Law under any of the following circumstances:

(1) The purpose is to provide products or services to natural persons within the territory;

(2) To analyze or evaluate the behavior of natural persons within the territory;

(3) Other circumstances as provided by laws and administrative regulations.

Regarding cross-border personal information transfer compliance for multinational corporations, the first issue to be discussed is whether such activities are subject to domestic relevant regulations. China's legislation adopts a legislative model combining territorial jurisdiction + protective jurisdiction. With regard to territorial jurisdiction, as long as personal information of natural persons is processed within the territory of the People's Republic of China, the Personal Information Protection Law and other regulations shall apply, regardless of whether the processing entity is a Chinese citizen or a Chinese enterprise. Therefore, when a multinational corporation within China provides information to a foreign company, it is subject to the Personal Information Protection Law and other regulations based on territorial jurisdiction.

Furthermore, with regard to protective jurisdiction, the provisions of Article 3, Paragraph 2 of the Personal Information Protection Law use the purpose and object of information processing activities as the criteria for determining protective jurisdiction, which basically covers all information processing activities directed at individuals or organizations within China, encompassing a relatively broad scope. At the same time, the Regulations supplement the situation of "involving processing of important data within the territory," causing the scope of application of the Personal Information Protection Law and other regulations to show a further expanding trend. Therefore, if the information transferred or processed within a multinational corporate group contains information of organizations or individuals within China or other important data involving the territory, there is a relatively high possibility that it will be regulated by the Personal Information Protection Law and other regulations.

II. Compliance Requirements for Cross-border Provision of Personal Information

(1) Prerequisites for Cross-border Provision of Personal Information

1. Security Assessment Filing Obligations for Special Entities

Article 40 of the PIPL

Critical information infrastructure operators and personal information processors that handle personal information reaching the quantity specified by the national cyberspace authority shall store the personal information collected and generated within the territory of the People's Republic of China domestically. Where it is truly necessary to provide such information overseas, a security assessment organized by the national cyberspace authority shall be passed; where laws, administrative regulations, and the national cyberspace authority provide that a security assessment may be exempted, such provisions shall apply.

According to the provisions of Article 40 of the PIPL, personal information processors that meet specific conditions and need to provide information overseas shall file with the national cyberspace authority for a security assessment. Furthermore, the Assessment Measures and other regulations further elaborate on the relevant contents of the security assessment.

（1）关键信息基础设施运营者

Article 2 of the "Regulations on the Security Protection of Critical Information Infrastructure" continues the provisions of the "Cybersecurity Law of the People's Republic of China," defining critical information infrastructure as important network facilities and information systems in sectors such as public communications and information services, energy, transportation, water conservancy, finance, public services, e-government, and defense science, technology and industry, as well as other important network facilities and information systems that, if damaged, lose function, or experience data leakage, may seriously endanger national security, national livelihood, and public interests.

（2）处理个人信息达到规定数量

After the Personal Information Protection Law (PIPL) introduced the requirement for security assessments, the Assessment Measures stipulated specific matters concerning such security assessments. Pursuant to Article 4 of the Assessment Measures, data processors that process personal information of 100 or more individuals, or that have cumulatively provided personal information of 10 or more individuals or sensitive personal information of 1 or more individuals to overseas recipients since January 1 of the previous year, must apply to the national cyberspace administration for a data export security assessment through the provincial cyberspace administration where they are located.

(3) Data Export Risk Self-Assessment

Pursuant to Article 5 of the Assessment Measures, data processors shall complete the data export risk self-assessment within 30 days prior to applying for a data export security assessment, and shall submit the data export risk self-assessment report together with the security assessment application. The data export risk self-assessment shall include the following contents:

（4）Assessment Matters for Data Cross-border Security Assessment

According to the provisions of Article 8 of the Assessment Measures, the specific content of data cross-border security assessment has similarities with the content of data cross-border risk self-assessment, as follows:

2. Prerequisites for cross-border provision of personal information of non-special subjects

Article 38 of the PIPL provides

Personal information processors that need to provide personal information to parties outside the People's Republic of China for business or other purposes shall meet one of the following conditions:

(1) Passing the security assessment organized by the national cyberspace authority in accordance with the provisions of Article 40 of this Law;

(2) Obtaining personal information protection certification from a professional institution in accordance with the provisions of the national cyberspace authority;

(3) Entering into a contract with the overseas recipient based on the standard contract formulated by the national cyberspace authority, stipulating the rights and obligations of both parties;

(4) Other conditions stipulated by laws, administrative regulations, or the national cyberspace authority.

Where international treaties or agreements concluded or acceded to by the People's Republic of China contain provisions on the conditions for providing personal information to parties outside the People's Republic of China, such provisions may be followed.

Personal information processors shall take necessary measures to ensure that the overseas recipient's processing of personal information meets the personal information protection standards stipulated in this Law.

For cross-border transfer of personal information by non-special entities, the PIPL adopts a pre-approval regulatory model. Unlike special entities that must undergo security assessment, non-special entities may choose to obtain certification from a professional institution in accordance with the provisions of the Cyberspace Administration of China, or enter into contracts with overseas recipients based on the standard contracts formulated by the Cyberspace Administration of China.

（1）Personal Information Protection Certification

The Certification Standards came into effect on December 16, 2022, further refining the relevant content concerning personal information protection certification. It is worth noting that the Certification Standards explicitly stipulate that overseas personal information processors may apply for certification through their domestically established specialized agencies or designated representatives, and bear legal responsibility. This implies that for multinational enterprises with cross-border data transfer needs, personal information protection certification can serve as an important pathway to ensure compliance of information processing.

（2）Standard Contract Formulated by the National Cyberspace Administration

The Cyberspace Administration of China announced the Standard Contract on June 30, 2022. The Standard Contract stipulates provisions concerning the purposes and scope of personal information cross-border transfer, obtaining prior separate consent, and other related matters. The contract content is summarized as follows:

It should be noted that the agreement on information processing between information handlers is key to ensuring compliance with cross-border personal information provision. A well-drafted information processing contract can help enterprises avoid most legal risks in the process of cross-border personal information provision. Therefore, in addition to satisfying the requirements of Article 38 of the Personal Information Protection Law, the Standard Contract may also serve as a reference for multinational enterprises when entering into contracts for other occasions involving information processing.

(2) Personal Information Security Impact Assessment

Article 55 of the Personal Information Protection Law provides

Personal information processors shall conduct a prior personal information protection impact assessment and keep records of the processing activities under any of the following circumstances: …(4) providing personal information overseas…

Personal information security impact assessment refers to the process of examining personal information processing activities to verify their compliance with laws and regulations, assess various risks of harm to the legitimate rights and interests of personal information subjects, and evaluate the effectiveness of measures taken to protect personal information subjects. Personal information protection impact assessment reports shall be retained for at least3years. According to Article 55 of the Personal Information Protection Law, if a personal information processor needs to transfer information cross-border, in addition to meeting the prerequisites mentioned above, a personal information security impact assessment shall be conducted separately. Currently, the National Information Security Standardization Technical Committee issued theAssessment Guidelineson June11,2018, providing reference texts on assessment implementation and assessment content.

(3) Separate Consent

Article 39 of the Personal Information Protection Law

Where a personal information processor provides personal information outside the People's Republic of China, it shall inform the individual of the name or title and contact information of the overseas recipient, the processing purposes and methods, the categories of personal information, and the methods and procedures for individuals to exercise their rights under this Law, and obtain the individual's separate consent.

Separate consent, according to Article 73 of the Regulations, refers to the data processor obtaining individual consent for each piece of personal information when conducting specific data processing activities, and shall not request consent for multiple pieces of personal information or involving multiple processing activities in a single request. Therefore, the practice where enterprises previously requested authorization for processing all personal information through a single request page can no longer meet the requirements of the current Personal Information Protection Law.

It is worth noting that Article 13 of the PIPL provides for exceptions to obtaining personal consent: when personal information is necessary for concluding or performing a contract to which the individual is a party, or when it is necessary for implementing human resource management in accordance with labor rules and regulations established according to law or collective contracts signed according to law, the personal information processor does not need to obtain the individual's consent. When multinational enterprises transfer employee personal information across borders within the enterprise for purposes such as corporate management, such transfers may to a certain extent meet the requirements of "necessary for implementing human resource management in accordance with labor rules and regulations and collective contracts signed according to law." Therefore, there is a question as to whether it is necessary to obtain separate consent from individuals under the above circumstances. Currently, there are no legally binding regulations or interpretations on this issue. This article is of the view that, on one hand, the "separate consent" as stipulated in Article 39 of the PIPL imposes higher requirements than the "consent" as stipulated in Article 13 of the PIPL, and they are not in a relationship of inclusion and being included. Therefore, the exemption conditions for "consent" cannot be automatically applied to "separate consent." On the other hand, in the context of cross-border information transfer, greater emphasis should be placed on the protection of personal information. Therefore, for prudent considerations, this article recommends that enterprises, under the above circumstances, mitigate potential legal risks by obtaining separate authorization documents such as "Authorization Consent Forms" signed with employees.