Nordic companies in China who transfer even small amounts of personal data to its affiliates outside China have to take action before 30 November 2023. The Ashurst-Guantao JOO team will update you on key developments to date and explain what you will need to do to comply.

Over the past 6 years, China have introduced a suite of legislation aimed at strengthening network security and protecting personal and important data.

The implementation has been gradual. Since September 2022, companies in China that transfer large amounts of personal data or so-called critical data outside of China have had to undergo a security assessment by the Cyberspace Administration of China (CAC). The relevant regulation also apply to subsidiaries of Nordic companies in China. However, the high thresholds (e.g. data relating to more than 1 million Chinese individuals) and the scope of critical data would have exempted many.

Another regulation was published on 22 February 2023 which regulates smaller cross-border transfers of personal data by companies in China. It directly targets those companies who were previously exempted. The following actions need to be taken by the transferor before the end of 30 November 2023:

• ensuring that consent have been obtained from the personal data subjects;
• entering into a data transfer agreement with the offshore data processor and filing the agreement with CAC; and
• preparing and submitting to CAC a personal information protection impact assessment (DPIA) report.

As a an alternative to submitting a data transfer agreement and DPIA to the regulator, the transferor may obtain a certification from an authorised third party (CCRC).

Join the FinnCham Shanghai and the Swedish Chamber of Commerce in China for a breakfast seminar where Ashurst-Guantao JOO will explain the requirements and the concrete steps you will need to take in the next few months.

Cancellation Policy

If you cannot attend an event for which you have registered, please cancel your registration no later than three （3） business day prior to the event. If you fail to notify us of your cancellation in a timely fashion, you will be charged for the event costs.

Fapiao (VAT Invoice)

• Ask your IT to whitelist the domain "XX@rightdo.net​"
• Apply fapiao when purchasing a ticket, by inputting the Chinese entity name and tax ID (if the title is wrong, you will be unable to receive the Fapaio)
• E-Fapiao will be sent to your e-mail within 7 days after completed event (check spam folder)
• If any problems, please email fang.sunjie@finnchamsh.org