China's data export rules create new risks

Significance

This is the latest step in China's rapidly expanding data protection regime, building on the Data Security Law which took effect in September and the Personal Information Protection Law, which took effect in November.

Impacts

• The rules will affect not just digital firms but all multinational firms that collect data from subsidiaries in China.
• It may sometimes be preferable to localise data analysis and circulate reports based on data rather than the raw data itself.
• The government will partially outsource enforcement to collective rights organisations to file class action lawsuits.
• Compliance costs will rise significantly, which may cause some companies to consider leaving China.