China asks smaller firms to declare data transfers abroad

SHANGHAI  -China on Friday moved to further strengthen its oversight of data, issuing a contract that smaller firms will be required to sign should they want to send user information abroad.

Beijing has in recent years issued new cybersecurity, data and privacy laws that require organizations with large user bases undergo assessments and approvals when handling the troves of data they collect.

The so-called standard contract issued by the Cyberspace Administration of China (CAC) on Friday looks to cover organisations with smaller user bases.

From June 1, parties that handle the personal information of up to one million people or which have sent the personal information of up to 100,000 individuals overseas since January last year will be required to sign such contracts, the CAC said.

They will be required to declare that they had conducted assessments before sending the information overseas, such as the risk of it being illegally used by overseas recipients, and file the contract with local CAC departments within 10 days of it taking effect.